fix(toolchain): removing a payload could not survive Windows

`toolchain remove` called remove_all and reported whatever it got. On
Windows that is "Access is denied", from either of two causes that look
identical:

  - payload files come out of .vsix/.msi carrying the read-only attribute.
    POSIX only needs the DIRECTORY writable to unlink a child, so this
    never appears on Linux or macOS -- and every unit test runs there.
  - a /Zi build leaves mspdbsrv.exe alive for a few seconds INSIDE the
    payload it is being asked to delete.

Handles both rather than betting on one: clear the write bit across the
tree and retry, then allow a bounded window (10 x 300ms) for a live
process to exit. Bounded because `toolchain remove` must not hang on a
directory something holds forever.

The error now names the file it is stuck on. "Access is denied" without a
path is not something a user can act on.

No unit test: on the only platform CI would run one, removing a read-only
file succeeds with or without this change, so the test could not fail.
e2e 239 on the Windows runner is the gate -- it is where this surfaced,
after the SDK fix let the build get far enough to reach the remove step.

Author: speak-agent

CHANGELOG.md

@@ -7,6 +7,17 @@
 
 ### 修复
 
+- **Windows 上 `mcpp toolchain remove <msvc toolset>` 报 "Access is denied"。**
+
+  `remove_all` 直接上,不清只读位、不重试、报错也不说是哪个文件。
+  payload 是从 .vsix/.msi 解出来的,归档条目带只读属性;POSIX 只要**目录**
+  可写就能 unlink 子项,所以这个问题在 Linux/macOS 上根本不出现。
+  另外 `/Zi` 构建之后 mspdbsrv.exe 还会在 payload 里活几秒。
+
+  两个原因表现完全一样(都是 "Access is denied"),所以两个都处理:
+  先清可写位重试,再给活着的进程一个**有上限**的等待窗口(10 × 300ms)。
+  报错现在会指出卡在哪个文件 —— 光一句 "Access is denied" 没法处理。
+
 - **半装的 Windows SDK 被当成装好的,链接到最后才炸。**
 
   `find_windows_sdk()` 认一个根的条件是 `Include\<v>\ucrt\corecrt.h`

src/toolchain/lifecycle.cppm

@@ -208,6 +208,66 @@ void msvc_print_detected(const mcpp::toolchain::msvc::MsvcInstallation& inst,
 // headers much later. `has_usable_msvc()` exists for exactly this reason;
 // this is the same judgement applied to the managed origin, where the SDK
 // arrives as a package dependency and can therefore fail on its own.
+// Delete a payload tree, coping with the two things that make a plain
+// `remove_all` fail on Windows and on nothing else:
+//
+//   read-only files — payloads are unpacked from .vsix/.msi, and archive
+//     entries carry the attribute through. POSIX only needs the DIRECTORY
+//     writable to unlink a child, so this never shows up on Linux or macOS.
+//   a lingering handle — a build with /Zi leaves mspdbsrv.exe running for a
+//     few seconds after cl.exe exits, and it lives inside the payload.
+//
+// Both surface as the same "Access is denied", which is why this handles both
+// rather than picking one: clear the attribute, then give a live process a
+// bounded moment to go away. Retries are capped and short — `toolchain
+// remove` should not hang because something holds the directory forever.
+bool remove_payload_tree(const std::filesystem::path& root,
+                         std::error_code& ec) {
+    std::filesystem::remove_all(root, ec);
+    if (!ec) return true;
+
+    // Second pass: make everything writable, then try again.
+    std::error_code ignore;
+    for (auto it = std::filesystem::recursive_directory_iterator(
+             root, std::filesystem::directory_options::skip_permission_denied,
+             ignore);
+         it != std::filesystem::recursive_directory_iterator{}; it.increment(ignore)) {
+        std::filesystem::permissions(it->path(), std::filesystem::perms::owner_write,
+                                     std::filesystem::perm_options::add, ignore);
+    }
+    for (int attempt = 0; attempt < 10; ++attempt) {
+        ec.clear();
+        std::filesystem::remove_all(root, ec);
+        if (!ec) return true;
+        std::this_thread::sleep_for(std::chrono::milliseconds{300});
+    }
+    return !std::filesystem::exists(root, ignore);
+}
+
+// The first entry that is still there after a failed removal. The error code
+// alone says "Access is denied" and not by whom or to what, which is the
+// difference between a report someone can act on and one they cannot.
+//
+// It probes by trying to delete, and keeps whatever it manages to delete --
+// acceptable only because the caller has already failed a remove_all and the
+// tree is being torn down anyway. Do not call it on a tree meant to survive.
+std::optional<std::filesystem::path>
+first_undeletable(const std::filesystem::path& root) {
+    std::error_code ec;
+    if (!std::filesystem::exists(root, ec)) return std::nullopt;
+    for (auto it = std::filesystem::recursive_directory_iterator(
+             root, std::filesystem::directory_options::skip_permission_denied, ec);
+         it != std::filesystem::recursive_directory_iterator{}; it.increment(ec)) {
+        if (ec) break;
+        if (it->is_regular_file(ec)) {
+            std::error_code rm;
+            std::filesystem::remove(it->path(), rm);
+            if (rm) return it->path();
+        }
+    }
+    return root;
+}
+
 void msvc_warn_if_sdk_missing(const mcpp::toolchain::msvc::MsvcInstallation& inst) {
     auto roots = mcpp::toolchain::msvc::sibling_sdk_roots(inst.clPath);
     if (auto sdk = mcpp::toolchain::msvc::find_windows_sdk(roots)) {
@@ -841,9 +901,14 @@ export int toolchain_remove(const mcpp::config::GlobalConfig& cfg,
             mcpp::ui::error(std::format("{} is not installed", spec));
             return 1;
         }
-        std::filesystem::remove_all(installDir, ec);
-        if (ec) {
-            mcpp::ui::error(std::format("remove failed: {}", ec.message()));
+        if (!remove_payload_tree(installDir, ec)) {
+            mcpp::ui::error(std::format(
+                "remove failed: {}{}", ec.message(),
+                first_undeletable(installDir)
+                    .transform([](const std::filesystem::path& p) {
+                        return std::format("\n         stuck at: {}", p.string());
+                    })
+                    .value_or(std::string{})));
             return 1;
         }
         mcpp::ui::status("Removed", spec);