Summary

Commit 1 — vendor (5fe20ebda):

• Vendor the Windows sandbox backend into internal/winsandbox with its MIT license and source notice.
• Switch Reasonix Windows sandbox helper code to the internal package.
• Remove the external github.com/SivanCola/windows-sandbox dependency from root and desktop modules, and update sandbox docs.

Commit 2 — Windows sandbox fixes (387cc2251):

Root cause of the "bash returns empty output on Windows" reports (#6046, #6051, #6067, #6070, #6072): the sandbox wrapper relaunches os.Executable() as a hidden helper (__reasonix_windows_sandbox), but only the CLI routed that subcommand — the desktop binary did not. On desktop, every sandboxed command therefore started a second GUI instance, which the Wails single-instance lock forwarded to the running app before exiting 0 with no output. The 1.17.3 escape prompt (#6032) never fired because it keys on the helper's exit-code-126 failure marker, which a dispatch-less binary never prints.

• Desktop helper route: desktop/main.go dispatches the helper subcommand before any Wails/single-instance setup, with cross-platform tests pinning the route (desktop/windows_sandbox_helper_test.go).
• Fail closed without a route: entry points declare the route via sandbox.RegisterHelperDispatch(); on Windows Available() stays false without it and Command/CommandArgs refuse to wrap — mirroring the darwin/linux wrappers — so a future dispatch-less embedder hits the existing clear-error / escape-approval path instead of silently swallowing output.
• Lock queue visibility ([Bug]: Shell调用始终返回空 #6067): per-root mutex waits are now sliced, emitting a one-line "waiting for another sandboxed command" notice after 2s instead of blocking silently for up to 10 minutes (WINDOWS_SANDBOX_LOCK_MS). First local modification to the vendored package, recorded in internal/winsandbox/NOTICE.md; covered by a new contention test.
• Doctor diagnostics ([Bug]: bash sandbox requested but unavailable on this platform #5961 / [Bug]: Bash返回空 #6046 confusion): reasonix doctor reports the resolved shell (Git Bash vs PowerShell is the first thing to check for low-integrity launch failures) and warns when a project reasonix.toml pins [sandbox], which overrides Settings/user-config edits.
• Docs: Windows sandbox troubleshooting section in GUIDE.md / GUIDE.zh-CN.md.

Fixes #6051, fixes #6067, fixes #6070, fixes #6072. Likely fixes #6046 (empty output matches the desktop dispatch gap; the "non-global workspace" detail there is unconfirmed). Improves diagnostics for #5961.

Verification

• go test ./... (root) and cd desktop && go test ./... — all green, including the new desktop helper-route tests and winsandbox lock-notice test.
• GOOS=windows GOARCH=amd64 go build ./... (root), go build . (desktop), and go test -c for internal/sandbox / internal/winsandbox / desktop — all compile.
• go vet (host + GOOS=windows) and gofmt clean.
• go list -m all in root and desktop has no SivanCola/windows-sandbox entry.
• Windows runtime behavior (real AppContainer launches, lock contention) needs Windows CI; new tests follow the existing skip conventions.