perf(crafter): de-duplicate AccessChk security descriptors in the policy projection
The SYSINTERNALS_ACCESSCHK material is projected to JSON client-side for policy evaluation. AccessChk evidence for a registry hive or service database applies a small number of distinct security descriptors to hundreds of thousands of objects through inheritance, and the flat projection repeats each descriptor inline on every object. The policy engine materializes every copy in memory, so a large material drives the CLI to very high peak memory and can OOM-kill the CI runner during evaluation.
This projects the material to a de-duplicated shape: the distinct security descriptors are emitted once in a descriptors table, and each object references one by index (descriptor). For a large registry material this reduces the projection by roughly 20x (hundreds of thousands of objects collapse to a few hundred distinct descriptors) and brings evaluation peak memory down by an order of magnitude. No object, name, or ACE is dropped — descriptors are shared only when byte-for-byte identical — so recorded evidence and policy findings are unchanged.
Policies read a descriptor via input.descriptors[obj.descriptor].
Closes PFM-6922.
AI assistance
This change was produced with the assistance of Claude Code.