test: stamp the Windows build-directory DACL inside the parallel runner

The workflow pre-created build\c with a protected DACL so build
products would inherit it, but the diagnostic note from the failing CI
shard named the real actor: MSYS2's Cygwin layer writes POSIX-emulating
DACLs — including a CREATOR OWNER (S-1-3-0) mutation grant — onto
directories its tools touch, overwriting the pre-created shape during
the build. The activation transaction's source-directory policy
correctly refuses that grant, so the install-flow tests failed on CI
while the VM (whose harness stamps AFTER building) stayed green.

The stamp now runs inside run-tests-parallel.sh on Windows, after any
builder has had its say and immediately before the suites — one code
path for CI and the VM. Two idempotent steps, as before: protect the
directory, then /reset the children onto the clean inherited set.

Verified: full VM parallel run green (6669 passed, 0 failed) through
the new path.

Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>

Author: DeusData

scripts/run-tests-parallel.sh

@@ -37,6 +37,28 @@ LOGDIR="$(dirname "$RUNNER")/test-logs"
 rm -rf "$LOGDIR"
 mkdir -p "$LOGDIR"
 
+# Windows: shape the build directory like a real user checkout BEFORE the
+# suites run. MSYS2's Cygwin layer writes POSIX-emulating DACLs — including
+# CREATOR OWNER (S-1-3-0) mutation grants — onto directories its tools
+# touch, and workspace drive roots additionally inherit Authenticated-Users
+# Modify; the activation transaction's source-directory policy correctly
+# refuses both, which would fail the install-flow tests on the environment,
+# not the code. Stamping must happen AFTER the build (the builders are the
+# ones re-writing the DACL), so it lives here rather than in workflow
+# setup. Two idempotent steps: protect the DIRECTORY (inheritance flags are
+# directory-only — a /T re-root leaves files with empty deny-all DACLs),
+# then /reset the children to re-inherit the clean set.
+case "$(uname -s 2>/dev/null)" in
+MINGW* | MSYS*)
+    runner_dir_w="$(cygpath -w "$(dirname "$RUNNER")")"
+    me="$(whoami | tr -d '\r')"
+    MSYS2_ARG_CONV_EXCL='*' icacls "$runner_dir_w" /inheritance:r \
+        /grant:r "${me}:(OI)(CI)F" '*S-1-5-18:(OI)(CI)F' '*S-1-5-32-544:(OI)(CI)F' \
+        /Q >/dev/null 2>&1 || true
+    MSYS2_ARG_CONV_EXCL='*' icacls "${runner_dir_w}\\*" /reset /T /C /Q >/dev/null 2>&1 || true
+    ;;
+esac
+
 SUITES_FILE="$LOGDIR/suites.txt"
 RESULTS_FILE="$LOGDIR/results.txt"