[Windows] Desktop app does not retain elevated administrator token

Summary\n\nOn Windows 11, the ChatGPT desktop app for Codex does not retain an elevated administrator token. After starting the app with administrator privileges, both the desktop process and its Codex child process still run with a limited token.\n\n## Expected behavior\n\nStarting the ChatGPT desktop app as administrator should allow the Codex agent to inherit elevated permissions, as described in the Windows app documentation:\nhttps://learn.chatgpt.com/docs/windows/windows-app#run-commands-with-elevated-permissions\n\n## Reproduction steps\n\n1. Close all ChatGPT/Codex processes.\n2. Start the Start-menu entry named ChatGPT using Run as administrator.\n3. Create a local Codex task and inspect the terminal/process token.\n4. Repeat after fully restarting the app.\n5. From an elevated PowerShell, run the bundled CLI command codex app and inspect the newly started desktop process.\n\n## Actual behavior\n\nEvery attempt produces a normal limited token:\n\n- ChatGPT.exe: Elevated = False, ElevationType = Limited\n- codex.exe: Elevated = False, ElevationType = Limited\n- Integrated shell: Medium integrity\n- The result is unchanged after a full app restart, so this is not a stale child process.\n- Calling the packaged executable directly with Start-Process ... -Verb RunAs fails with Access denied because it is under the WindowsApps package directory.\n\n## Environment\n\n- Windows 11 Pro, build 26200\n- ChatGPT desktop package: OpenAI.Codex 26.908.9136.0\n- Codex CLI: 0.154.0-alpha.6.2\n- Package manifest entry point: Windows.FullTrustApplication\n- No newer package was offered by winget at the time of testing.\n\nThis prevents local tasks that need administrator rights (for example services, drivers, firewall rules, or HKLM changes) from completing in the desktop app. No logs or session transcripts are attached because they may contain private data.

Start by tracing the Windows.FullTrustApplication package entry point and the codex app launch path, then reproduce the token checks from the issue in an elevated PowerShell. Compare the desktop process, Codex child process, and integrated shell with the Windows app documentation. Done means administrator-launched tasks retain elevated permissions while normal launches remain unchanged.