Sandbox enforcement probe fails with CreateProcessW error 2 on Windows when failIfUnavailable: true (managed settings) #5368

Environment

• GitHub Copilot CLI 1.0.105 (stable). Also reproduced on 1.0.106-9 and 1.0.106-10 (pre-release).
• Windows 11 Pro, build 26200.9711, x64. Administrator account with UAC enabled; the Copilot session runs with a standard token.
• Managed settings file: %ProgramFiles%\GitHubCopilot\managed-settings.json.

Managed settings that reproduce it

{
  "sandbox": { "enabled": true, "failIfUnavailable": true, "allowBypass": false },
  "permissions": { "disableBypassPermissionsMode": "disable" }
}

Steps

1. Save the file above as the managed settings file.
2. Run from an interactive desktop session: copilot --sandbox --allow-all-tools -s -p "Run exactly this command with cmd /c and report only the output line: echo sandbox-probe"
3. Repeat.

Expected: sandbox-probe.

Actual (every run):

Error executing prompt: Error: Request session.send failed with message: This session is blocked because your organization's sandbox policy requires enforcement, but the sandbox is unavailable: backend_error: CreateProcessW failed with error code 2 (0x00000002). (CreateProcessW(PROC_THREAD_ATTRIBUTE_SECURITY_ENVIRONMENT) failed: WIN32_ERROR(2) ...)

Earlier variant of the same error: sandbox enforcement probe exited with status -1073741502.

Observations

• Removing failIfUnavailable makes the sandbox start, so the failure is specific to the enforcement probe.
• Removing any one of allowBypass, addCurrentWorkingDirectory, auth, or permissions does not fix it (3 runs each).
• With no managed file, sandboxed cmd /c works in the same session.
• The MXC runner (wxc-exec.exe) with the same filesystem policy, UI disabled, passed 10/10, so the backend itself works.
• The same probe passes 3/3 when run from an interactive PowerShell window, and 5/5 when run from a scheduled task in the logged-on session. It fails in non-interactive SSH sessions.

Question: Is the enforcement probe expected to pass on this configuration? If not, what does it need (UI access, a particular path, a helper binary)?