recover stale Windows sandbox credentials

[iceweasel-oai]

Why

The elevated Windows sandbox persists dedicated sandbox account credentials so later commands can launch without reprovisioning. If those persisted credentials drift from the actual Windows account password, CreateProcessWithLogonW fails with ERROR_LOGON_FAILURE and Codex currently surfaces that as a hard runner launch failure.

This change makes that failure self-healing. When Windows specifically rejects the sandbox login, Codex now treats the persisted sandbox credentials as stale, regenerates them through the existing setup path, and retries the runner launch once.

What Changed

• Preserve CreateProcessWithLogonW failures as a typed runner logon error so callers can distinguish ERROR_LOGON_FAILURE from unrelated launch failures.
• Add a sandbox credential refresh helper that deletes the persisted sandbox_users.json record and reuses require_logon_sandbox_creds() to reprovision credentials through the established setup flow.
• Retry elevated runner startup after stale-credential failures in both the legacy elevated capture path and unified exec elevated backend.
• Add focused tests for stale logon failure detection and persisted sandbox user file removal.

Validation

• git diff --check
• cargo test -p codex-windows-sandbox