bd504bee6d
Adds a Windows-live diagnostic that, against a cookie DB held by a running Chrome, reports which read strategy succeeds: shutil, open-rb, sqlite mode=ro, sqlite immutable=1, sqlite ro+nolock, raw win32 CreateFile with full share flags. This tells us empirically whether any in-process read path exists (immutable=1 / share-all open) before reaching for VSS/admin. Fails-closed test marked xfail while the real behavior is derived from the diagnostic.