The sandbox Service Definition adds SandboxEscalationError with
SANDBOX_ESCALATION_INVALID_ARGUMENT, _UNAVAILABLE, _REJECTED, and
_CANCELLED, thrown by validateEscalationArgs() and approveEscalation()
with their existing messages. A cancelled approval for an aborted call
rethrows the call's cancellation instead.
It also adds SandboxPreparationError. sandbox-local wraps Windows ACL
SID, grant, temp-directory, and path-resolution failures as
SANDBOX_PREPARATION_FAILED with the Win32Error or Node error (or an
AggregateError with cleanup failures) as cause, and reports a temp root
inside the workspace as SANDBOX_INVALID_TEMP_ROOT. sandbox-windows-acl
exports isTempRootInsideWorkspace() for that check.
Refs #7869
sjw1231
9626ccfae8