给隔离测试配置加上可选的 Windows ACL 加固注入点：默认真实实现

- agent-swarm-test-chat.mjs：secureWindowsPrivateRuntimePath 增加可选第三参 secureWindowsPath，传入时直接调用它，不传时完整保留原有的 await import + secureWindowsGameCreatorPathForCurrentUser 调用。
- agent-swarm-test-chat.mjs：copyPrivateRuntimeConfigEntry 增加可选第五参 secureWindowsPath，并透传给上面的加固函数。
- agent-swarm-test-chat.mjs：prepareSwarmTestRuntimeConfig 增加可选第三参 { secureWindowsPath = null } = {}，透传给运行配置目录加固与两次配置文件复制。
- 生产路径行为逐字不变：默认值为 null 时 if 分支不进入，执行的原语句与改动前完全一致；唯一生产调用点仍按单参调用（prepareSwarmTestRuntimeConfig(sourceConfigDir)）。
- 加这个接缝的原因：Windows 上每次私有路径加固都要拉起一个真实 powershell.exe（本机实测约 0.6 秒 / 次），一次 prepareSwarmTestRuntimeConfig 在双配置文件场景最多加固 3 次，只校验隔离与清理语义的用例不该为此耗掉 vitest 的 5000ms 默认预算。

apps/ai-game-creator-shell/scripts/agent-swarm-test-chat.mjs

@@ -371,7 +371,15 @@ async function runMissingConfigWizard(setActiveChild, explicitConfigDir) {
   }
 }
 
-async function secureWindowsPrivateRuntimePath(targetPath, options) {
+async function secureWindowsPrivateRuntimePath(
+  targetPath,
+  options,
+  secureWindowsPath = null,
+) {
+  if (secureWindowsPath) {
+    await secureWindowsPath(targetPath, options);
+    return;
+  }
   const { secureWindowsGameCreatorPathForCurrentUser } = await import(
     './game-creator-config-wizard.mjs'
   );
@@ -383,6 +391,7 @@ async function copyPrivateRuntimeConfigEntry(
   runtimeConfigDir,
   fileName,
   required,
+  secureWindowsPath = null,
 ) {
   const sourcePath = path.join(sourceConfigDir, fileName);
   const sourceMetadata = await lstat(sourcePath).catch((error) => {
@@ -402,9 +411,11 @@ async function copyPrivateRuntimeConfigEntry(
     const sourceBytes = await readFile(sourcePath);
     const destinationFile = await open(destinationPath, 'wx', 0o600);
     try {
-      await secureWindowsPrivateRuntimePath(destinationPath, {
-        isDirectory: false,
-      });
+      await secureWindowsPrivateRuntimePath(
+        destinationPath,
+        { isDirectory: false },
+        secureWindowsPath,
+      );
       await destinationFile.writeFile(sourceBytes);
       await destinationFile.sync();
     } finally {
@@ -437,7 +448,11 @@ async function copyPrivateRuntimeConfigEntry(
   return true;
 }
 
-export async function prepareSwarmTestRuntimeConfig(sourceConfigDir, tempRoot) {
+export async function prepareSwarmTestRuntimeConfig(
+  sourceConfigDir,
+  tempRoot,
+  { secureWindowsPath = null } = {},
+) {
   if (!path.isAbsolute(sourceConfigDir)) {
     throw new Error('配置来源目录必须是绝对路径');
   }
@@ -457,9 +472,11 @@ export async function prepareSwarmTestRuntimeConfig(sourceConfigDir, tempRoot) {
   );
   try {
     if (process.platform === 'win32') {
-      await secureWindowsPrivateRuntimePath(runtimeConfigDir, {
-        isDirectory: true,
-      });
+      await secureWindowsPrivateRuntimePath(
+        runtimeConfigDir,
+        { isDirectory: true },
+        secureWindowsPath,
+      );
     } else {
       await chmod(runtimeConfigDir, 0o700);
     }
@@ -477,12 +494,14 @@ export async function prepareSwarmTestRuntimeConfig(sourceConfigDir, tempRoot) {
       runtimeConfigDir,
       configFileName,
       true,
+      secureWindowsPath,
     );
     await copyPrivateRuntimeConfigEntry(
       canonicalSourceConfigDir,
       runtimeConfigDir,
       localConfigFileName,
       false,
+      secureWindowsPath,
     );
     return {
       path: await realpath(runtimeConfigDir),