check PID of named pipe consumer

[iceweasel-oai]

Why

The elevated Windows command runner currently trusts the first process that connects to its parent-created named pipes. Tightening the pipe ACL already narrows who can reach that boundary, but verifying the connected client PID gives the parent one more fail-closed check: it only accepts the exact runner process it just spawned.

What changed

• validate GetNamedPipeClientProcessId after ConnectNamedPipe and reject clients whose PID does not match the spawned runner
• also did some code de-duplication to route the one-shot elevated capture flow in windows-sandbox-rs/src/elevated_impl.rs through spawn_runner_transport() so both elevated codepaths use the same pipe bootstrap and PID validation

Using the transport unification here also reduces duplication in the elevated Windows IPC bootstrap, so future hardening to the runner handshake only needs to land in one place.

Validation

• cargo test -p codex-windows-sandbox
• manual testing: one-shot elevated path via target/debug/codex.exe exec running a randomized shell command and confirming captured output
• manual testing: elevated session path via target/debug/codex.exe -c 'windows.sandbox="elevated"' sandbox windows -- python -u -c ... with stdin/stdout round-trips (READY, then GOT:... for two input lines)