fix(fspy): trace Windows process images

[wan9chi]

Motivation

Windows Server 2022 can perform executable image lookup entirely inside NtCreateUserProcess, bypassing the user-mode NT file APIs fspy currently hooks. That can omit executable inputs from automatic cache fingerprints and causes the process-image tracing tests to fail on build 20348.

What changed

• Trace the kernel-facing PS_ATTRIBUTE_IMAGE_NAME at the NtCreateUserProcess boundary.
• Parse the variable-length native attribute list and borrow its counted UTF-16 image path without allocating.
• Initialize STARTUPINFO.cb correctly in the direct Win32 process tests.
• Document the user-visible Windows tracing fix in the changelog.

[wan9chi]

• fix(fspy): trace Windows process images #518 👈 (View in Graphite)
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 56f2af1c24

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".