test: reset Windows native runs from clean baseline

docs/testing.md

@@ -49,6 +49,7 @@ scripts/windows/build-test-bundle \
 scripts/windows/test-host prepare --run-id windows-smoke
 scripts/windows/test-host stage --run-id windows-smoke \
   --bundle .test-runs/windows-smoke/windows-bundle
+scripts/windows/test-host install --run-id windows-smoke
 ```
 
 The bundle manifest records the source commit and SHA-256 of every bundled
@@ -151,16 +152,17 @@ The provisioned fixture's non-secret identity values, including the host-local
 password-file path, are safe defaults in that script and may be overridden for
 another documented fixture; the password itself is never embedded.
 
-The native lifecycle is `status`, `prepare`, `stage`, `run`, `collect`,
-`stop`, and `reset`. `prepare` verifies the VM and snapshot UUIDs, restores the
-baseline, starts headless, waits for Guest Additions, and records the selected
-login fixture. `stage` copies a versioned non-secret test bundle through a
-run-specific host directory to a run-specific guest directory. `run` starts
-the real RVBox SCM service and observes it through SCM, the local health/tray
-pipe, durable artifacts, and the test agent endpoint; it must not invoke the
-GUI-subsystem `rvbox.exe` directly through Guest Control. `collect` obtains
-only bounded/redacted artifacts, and `reset` restores the exact baseline and
-leaves the VM powered off.
+The native lifecycle is `status`, `prepare`, `stage`, `install`, `run`,
+`collect`, `stop`, and `reset`. `prepare` verifies the VM and snapshot UUIDs,
+restores the clean baseline, starts headless, waits for Guest Additions, and
+proves that `RVBoxClient` is absent. `stage` copies a versioned non-secret test
+bundle through a run-specific host directory to a run-specific guest directory.
+`install` uses the fixture-only high-integrity automation principal to invoke
+the real `rvbox.exe --install-service` path and proves completion through SCM.
+`run` is for reconfiguration/restart scenarios after that first installation.
+Neither action invokes the GUI-subsystem executable directly with the normal
+Guest Control account. `collect` obtains only bounded/redacted artifacts, and
+`reset` restores the exact clean baseline and leaves the VM powered off.
 
 This service-driven protocol is required because VirtualBox Guest Control
 7.2.16 does not reliably complete a direct GUI-subsystem `rvbox.exe` run;
@@ -171,14 +173,17 @@ also performs a bounded guest-to-nginx HTTPS/TCP readiness probe before it
 starts the service. Wine and protocol stubs are not equivalent Windows
 coverage.
 
-The fixture needs a one-time operator-approved service bootstrap before the
-SCM smoke lane can run: Guest Control supplies the split-token administrator's
-medium UAC token, so it cannot safely install services. The bootstrap installs
-the test service in the reset baseline and grants the test account only the SCM
-query/change-config/start/stop rights plus access to its dedicated test subtree.
-Each run then reconfigures and starts that one service. This does not add a
-product broker or use Task Scheduler; it is fixture setup. See
-[testing-vm.md](testing-vm.md) for the exact boundary.
+The clean baseline intentionally contains no RVBox service, tray registration,
+or RVBox state. Guest Control supplies `rvboxtest` with a filtered medium UAC
+token, so it cannot safely perform the first machine-wide install. The fixture
+therefore has a separate test-only full-token automation principal, whose
+username and mode-600 host-side password-file are provided only as
+`RVBOX_TEST_PROVISIONER_USER` and `RVBOX_TEST_PROVISIONER_PASSWORD_FILE` for
+the `install`/machine-mutation actions. It is not an RVBox process, service,
+broker, or Task Scheduler dependency, and it is never used to choose a command
+execution context. The normal `rvboxtest` console session remains the subject
+of active-user and elevation tests. See [testing-vm.md](testing-vm.md) for the
+exact fixture contract.
 
 The VM is the minimum smoke lane, so native multi-session/ambiguous-session,
 Server Core, and older-build entries remain explicitly blocked until their own