fix(agent): trust LOCAL SERVICE writes on broker security checks

[Vladyslav Nikonov (vnikonov-devolutions)]

Fixes the package broker policy file failing to load on stock installations.

The Agent installer creates C:\ProgramData\Devolutions\Agent with write access granted to LOCAL SERVICE, and the broker's anti-tampering verification rejected that DACL, preventing the policy from loading. LOCAL SERVICE already holds elevated rights on the host, so trusting it does not extend the attack surface. NETWORK SERVICE remains untrusted (covered by a regression test).

[github-actions]

Let maintainers know that an action is required on their side

• Add the label release-required Please cut a new release (Devolutions Gateway, Devolutions Agent, Jetsocat, PowerShell module) when you request a maintainer to cut a new release (Devolutions Gateway, Devolutions Agent, Jetsocat, PowerShell module)

• Add the label release-blocker Follow-up is required before cutting a new release if a follow-up is required before cutting a new release

• Add the label publish-required Please publish libraries (`Devolutions.Gateway.Utils`, OpenAPI clients, etc) when you request a maintainer to publish libraries (Devolutions.Gateway.Utils, OpenAPI clients, etc.)

• Add the label publish-blocker Follow-up is required before publishing libraries if a follow-up is required before publishing libraries

[Copilot]

Pull request overview

Updates broker security checks to accept LOCAL SERVICE writes required by stock Agent installations.

Changes:

• Adds LOCAL SERVICE as a trusted SID.
• Adds regression tests for LOCAL SERVICE and NETWORK SERVICE.
• Updates security documentation.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Benoît Cortier (CBenoit)]

LGTM