[fergusstrange]

Windows startup from an elevated PowerShell context could fail with initdb: could not open process token: error code 5. Restricted children inherited permissions that depended on the disabled Administrators SID. The new restricted token and its default objects now grant access to the actual user and SYSTEM, allowing children to reopen their own tokens. Administrator and power-user groups remain deny-only, privileges stay restricted, and existing caller tokens and directory ACLs are unchanged.

Windows CI now exercises nested token access, Go/CLI lifecycles under Go 1.26.9 and 1.27.2 directly from PowerShell, and the detached hidden Node launch used by the wrapper. The PowerShell checks build normal CLI executables, while the existing instrumented native suites continue to supply coverage. Caller-owned Windows directory-access requirements are documented.

Adds a public post-publication workflow and a local reproduction command for actual Go module/CLI consumers: six native platforms and x64/ARM64 Alpine, both supported Go versions, exact source identity, checksums, build attestations, fresh downloads, SQL, offline reuse and cleanup. Evidence stays in the public product repository; no private validation repository is needed.

Validation at e9493a7870f163c4b84dcbb225a75556e703aab0:

• All 13 required CI checks passed, including PowerShell and detached Node launches on Windows x64 and ARM64; Windows ARM64 exercised the shipping x64 PostgreSQL selection.
• Aggregate production coverage is 90.92% (1563/1719) against the unchanged 90% requirement. Native suites, race checks where supported, lint, vet, vulnerability analysis and CodeQL passed.
• The public reproduction script passed against the existing published alpha.4 on macOS ARM64 and native ARM64 Alpine, including attestation and cleanup checks. The new fixed release will be checked by the public workflow after publication. Workflow lint and local Python checks passed.