docs(mxc): document Windows host preparation (NVBug 6842834)

[prekshivyas]

Summary

Document Windows host preparation for live MXC ProcessContainer runs. Use a standalone wxc-exec.exe outside MSIX/WindowsApps package directories, and apply system-drive ACL preparation only when MXC selects the AppContainer + DACL fallback tier and its probe recommends the change.

Related Issue

• NVBug 6842834
• No public GitHub issue required: focused Windows MXC setup documentation fix.

Changes

• Document the standalone executable path in the driver README, three shipped example READMEs, and the published gateway configuration reference.
• Check wxc-exec.exe --probe before host preparation. BaseContainer and AppContainer + BFS do not require the documented system-drive ACL change.
• Explain the persistent, host-wide, non-inheriting metadata grant and distinguish it from directory listing, write access, and descendant ACL changes.
• Treat Access Denied and exit code 1 as diagnostic starting points rather than proof that host ACL preparation is missing.
• Link Microsoft's MXC host-preparation guide for verification, other prerequisites, and rollback.

Testing

• Current-head Branch Checks passed at 0cea165bbaaf188925dbe95410b453697d65d730, including all three Rust platforms. PR rollup: 30 passed, 34 skipped, no failing or pending checks.

• mise run markdown:lint: 139 Markdown files, zero errors; 185 Mermaid-scanned files, all diagrams valid.

• Repository-pinned Fern 5.112.0 check: zero errors, three existing warnings.

• uv run --no-project python scripts/update_license_headers.py --check: all 991 files passed.

• Rust formatting checks completed successfully during pre-commit.

• git diff --check.

• All five edited files reviewed against upstream MXC host-preparation documentation and tier-selection behavior.

• mise run pre-commit passes. Attempted on native Windows ARM64; the aggregate failed while building the unchanged grpcio-tools==1.78.0 Python dependency for CPython 3.14. The focused checks above passed. The follow-up documentation commit bypassed only the repeated local hook invocation after recording this failure; current-head GitHub CI remains the merge gate.

• Unit and E2E tests: not applicable to this documentation-only change. No runtime code or Windows build/test workflows changed.

The host-preparation command was not executed because it persistently changes host ACLs. Documentation checks do not claim live MXC qualification on either x64 or ARM64.

Checklist

• Follows Conventional Commits.
• Commits are signed off for DCO.
• Published configuration reference and shipped example documentation updated consistently.
• Architecture and relevant skill references reviewed; existing links already lead to the updated operational guidance.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[shailendra-nv]

/ok to test 0cea165

[shailendra-nv]

Re-reviewed the complete five-file documentation diff at 0cea165 against windows, including the MXC launch/error paths, upstream tier-selection and host-preparation documentation, shipped example consistency, and architecture/skill references. No remaining blocking findings.

The system-drive ACL preparation is now conditional on the AppContainer + DACL tier and the probe recommendation. All five copies explain its scope and link the upstream verification/rollback guide. Generic Access Denied and exit code 1 no longer imply that a host ACL change is needed.

Local Markdown/Mermaid, pinned Fern, standalone license, Rust formatting, and diff checks passed. The full local pre-commit attempt was limited by the unchanged grpcio-tools build on Windows ARM64; this is recorded in the PR. No live host ACL changes or MXC qualification were performed for this documentation-only update.

Current-head CI is green: 30 passed checks, 34 skipped, no failures or pending checks. Verified a clean merge against windows at 4cb6054. READY_TO_MERGE.