test: guard Windows active-session fixture isolation

scripts/windows/test-host

@@ -250,6 +250,15 @@ assert_staged_guest() {
         fail "staged guest bundle is missing rvbox.exe or client.toml"
 }
 
+assert_provisioner_absent() {
+    # A second logged-on Administrator could become an additional WTS active
+    # candidate and invalidate ACTIVE_* selection tests.  Do not guess which
+    # account the supervisor would choose: fail before dispatch and reset.
+    guest_run --exe 'C:\Windows\System32\cmd.exe' --wait-stdout --wait-stderr --unquoted-args -- \
+        /d /s /c "query user | findstr /i /c:\"$provisioner_user\" >NUL & if errorlevel 1 echo RVBOX_GUEST_OK" >/dev/null || \
+        fail "fixture provisioner remains logged on; reset before active-session tests"
+}
+
 wait_guest_additions() {
     attempt=0
     while [ "$attempt" -lt 60 ]; do
@@ -357,6 +366,7 @@ case "$action" in
             run --exe "$guest_root\\rvbox.exe" --unquoted-args -- \
             --install-service --config "$guest_root\\client.toml" </dev/null >/dev/null 2>&1 || true
         wait_service RUNNING
+        assert_provisioner_absent
         step install-scm-service-running
         printf 'service=RVBoxClient state=RUNNING install=clean-baseline\n'
         ;;