bug(windows): restore missing binary path normalization #5013

User Story

For the requested native OpenShell Windows sandbox workflow, an operator needs executable-scoped network rules to match Windows-equivalent path spellings. The fix needs to land on NVIDIA/OpenShell:windows before it is carried into the downstream Windows repository.

Problem Statement

The normalization behavior from #3482 is missing from the current windows branch at 5d1bfbf92135f4ee899f80999ccdf09152b77964. Policy and runtime executable paths are still compared without Windows separator normalization or verified case-insensitive matching.

The branch's complete source tree is identical to the base used for the prepared normalization fix. Native Windows ARM64 regression tests against the unmodified runtime reject c:/windows/system32/curl.exe when a YAML or protobuf policy names C:\WINDOWS\SYSTEM32\CURL.EXE.

Impact / Why This Matters

A permitted executable can receive a proxy denial solely because its observed path differs in slash direction or ASCII case. Copying the runtime path's exact spelling into every rule is a brittle workaround across policy-authoring tools and executable-path sources.

Acceptance Criteria

• Ordinary Windows paths match across / and \ in YAML and protobuf policies, through both connection and HTTP request checks.
• ASCII case differences match only when every parent directory of the trusted runtime executable is confirmed case-insensitive.
• Case-sensitive or indeterminate directories retain exact case matching; UNC, device, and verbatim namespace paths retain exact spelling.
• Policy-authored paths are never opened, different executables and command-line-only paths do not inherit grants, and original executable paths remain available for hashing.
• Non-Windows matching keeps its existing behavior.
• Native Windows regression tests and the MXC socket-owner E2E scenario pass.

Reproduction Steps

1. Load an OpenShell network rule granting example.com:443 to C:\WINDOWS\SYSTEM32\CURL.EXE.
2. Evaluate a connection with trusted executable path c:/windows/system32/curl.exe on ordinary case-insensitive Windows system directories.
3. Observe denial. The same failure occurs with YAML and protobuf policy loading.

The two added source-level regression tests, run against the otherwise unmodified runtime on Windows ARM64, produced 0 passed, 2 failed, 0 ignored. Their command was cargo test --offline --locked --target aarch64-pc-windows-msvc -p openshell-supervisor-network --lib matches_windows_equivalent_binary_path -- --nocapture --test-threads=1.

Environment

• OpenShell: windows branch at 5d1bfbf92135f4ee899f80999ccdf09152b77964.
• OS: native Windows 11 ARM64.
• Toolchain: Rust 1.95.0, aarch64-pc-windows-msvc.
• Runtime: native MXC sandboxes and their host network supervisor.

Related Work

• Original normalization fix: fix(network): normalize Windows binary paths (NVBug 6782969) #3482.
• Scope: restore binary-path normalization on windows; other Windows changes are separate work.