Host sandboxed CEF subprocesses in obs64

[summeroff]

Summary

• classify and dispatch CEF child invocations before normal OSN startup
• export the versioned sandbox lifecycle ABI from obs64.exe and link the host to OBS::cef-sandbox
• load only the packaged obs-browser.dll for child dispatch and reject malformed, unknown, duplicate, or --no-sandbox invocations
• leave the CEF/browser DLL chain loaded after CefExecuteProcess returns, avoiding child-exit unload races
• isolate the /MD Crashpad implementation in osn-crashpad-bridge.dll so the /MT CEF sandbox can link safely
• scope /MT to obs64 and its static link closure; retain /MD and /MDd for the Electron addon and its IPC archive
• add focused subprocess classification, argument logging, install-path, and CRT guards
• consume published libobs 32.1.1sl10cef1

Dependencies / draft status

• depends on Package and export Windows CEF sandbox support obs-studio#775
• pinned test artifact: libobs-windows64-release-32.1.1sl10cef1.7z
• artifact SHA-256: B347C8948B820E2C822366B4DABA1BD93FDF75F47E1C6B5F0FD9E4C4995AC23D
• remains draft until runtime evidence confirms restricted process tokens and job-object confinement for renderer, GPU, utility-service, and Crashpad children
• absence of --no-sandbox is not closure evidence

CRT boundary

lib-streamlabs-ipc is built twice because it links into both the Electron addon and obs64. The addon variant remains /MD or /MDd; the obs64 variant and host static closure use /MT. The Crashpad bridge exposes a C-only synchronous boundary: no CRT allocation, C++ object, FILE*, fd/HANDLE ownership, or errno state crosses it.

Validation

• Release builds: lib-streamlabs-ipc-obs64, server unit tests, obs64.exe, and obs_studio_client.node
• Release server suite: 25/25; focused CEF suite: 5/5
• Debug server unit-test and addon builds; focused CEF suite: 5/5
• generated projects confirm Release addon /MD, Debug addon /MDd with _DEBUG retained, and obs64 link closure /MT
• clang-format 19.1.5 and git diff --check
• GitHub CI passes Windows build/tests, both macOS builds/tests, formatting, and CodeQL

Remaining release gates

• record token restrictions and job membership for every supported CEF child class, including service-sandbox-type=none and the embedded Crashpad handler
• run a real Crashpad crash-report smoke test
• measure per-renderer working set and browser-source startup latency now that children load the obs64 dependency chain
• canonical install-path checks resist junction redirection but do not make an attacker-writable install root trustworthy

Supersedes #1779 after the source branch was renamed to remove an internal issue identifier.