Permissive Learning Mode 6/6 Testing

[lilybarkley-msft]

📖 Description

PR 6 of 6 — stacked on PR5. Final PR; restores the testing artifacts that were temporarily held back for readability of PRs 1–5.

• src/testing/plm_tester — Windows-only workload binary (plmtester) that deliberately trips the FS, capability, and UI access-denied paths PLM is meant to capture:
  • Filesystem reads/writes outside the allowed roots
  • Capability-gated accesses (screenshot, etc.)
  • UI violations: clipboard, display settings, system parameters, find-window, child-window injection
  • Re-added to the Rust workspace members in src/Cargo.toml.
• tests/configs/plm_configs/ — input configs that pair with plmtester invocations, one per access category (filesystem promoted / not promoted / readonly / readwrite, capabilities, UI categories).
• tests/scripts/run_plm_test.ps1 — end-to-end driver: runs wxc-exec --audit against each plm_configs/*.json workload, captures the resulting Adjusted_*.json, and asserts the expected fields were added (or correctly withheld for the deny-listed cases).

After this PR merges, the tree on top of main is bit-identical to the pre-split source branch.

🔗 References

• Base: PR5 (user/lilybarkley/plm-pr5-ui-policy)
• Closes out the 6-PR split (PR1 → PR6). Once all six land in order, the merged tree equals the original branch tip.

🔍 Validation

• cargo build -p plm -p plmtester --target x86_64-pc-windows-msvc — clean
• cargo fmt --all -- --check — clean
• cargo clippy -p plm -p plmtester --target x86_64-pc-windows-msvc --all-targets -- -D warnings — clean
• cargo test -p plm --target x86_64-pc-windows-msvc — 126 passed
• git diff <pr6-tip> <original-branch-tip> — empty (verified locally; the six commits in order reproduce the original tree exactly).
• tests/scripts/run_plm_test.ps1 end-to-end driver included for manual + CI execution.

✅ Checklist

• Signed the Contributor License Agreement
• Linked to an issue
• Updated documentation (if applicable)
• Updated Copilot instructions (if build, architecture, or conventions changed)

📋 Issue Type

• Bug fix
• Feature
• Task

---

GitHub Actions runs the PR validation build automatically. The ADO pipeline
(MXC-PR-Build) is the official build pipeline that signs the binaries; it
runs on merge to main and nightly, and Microsoft reviewers can trigger it
on a PR with /azp run. See docs/pull-requests.md.

Microsoft Reviewers: Open in CodeFlow