Isolate Windows native lifecycle self-test state

.github/workflows/unified-agent-native.yml

@@ -111,7 +111,10 @@ jobs:
         run: |
           go build -o pulse-agent-native.exe ./cmd/pulse-agent
           .\pulse-agent-native.exe --version
-          .\pulse-agent-native.exe --self-test
+          $selfTestStateDir = Join-Path $env:RUNNER_TEMP 'pulse-agent-self-test'
+          $selfTestLogFile = Join-Path $selfTestStateDir 'pulse-agent.log'
+          New-Item -ItemType Directory -Path $selfTestStateDir -Force | Out-Null
+          .\pulse-agent-native.exe --self-test --state-dir $selfTestStateDir --log-file $selfTestLogFile
           $errors = $null
           [System.Management.Automation.Language.Parser]::ParseFile(
             (Resolve-Path 'scripts/install.ps1'),

docs/release-control/v6/internal/subsystems/agent-lifecycle.md

@@ -4956,7 +4956,10 @@ Native support evidence is governed by
 `.github/workflows/unified-agent-native.yml`. Cross-compilation and archive
 presence are build evidence only; platform support claims must name native CI,
 native installed-lifecycle, appliance-lab, and platform code-signing evidence
-separately.
+separately. The native Windows binary self-test must use runner-temporary state
+and logging paths so it cannot create the machine-global `ProgramData\Pulse`
+directory before the same job exercises the clean install, update, service
+recovery, and uninstall lifecycle.
 
 Normal release promotion requires platform-native identity for desktop agent
 binaries. macOS agents must be Developer ID signed, submitted successfully to

scripts/installtests/install_ps1_test.go

@@ -102,6 +102,25 @@ func TestWindowsAgentLifecycleHarnessPinsCompleteServiceProof(t *testing.T) {
 	}
 }
 
+func TestNativeWindowsSelfTestDoesNotPreseedLifecycleState(t *testing.T) {
+	content, err := os.ReadFile(repoFile(".github", "workflows", "unified-agent-native.yml"))
+	if err != nil {
+		t.Fatalf("read native agent workflow: %v", err)
+	}
+
+	workflow := string(content)
+	required := []string{
+		`$selfTestStateDir = Join-Path $env:RUNNER_TEMP 'pulse-agent-self-test'`,
+		`$selfTestLogFile = Join-Path $selfTestStateDir 'pulse-agent.log'`,
+		`--self-test --state-dir $selfTestStateDir --log-file $selfTestLogFile`,
+	}
+	for _, needle := range required {
+		if !strings.Contains(workflow, needle) {
+			t.Fatalf("native Windows self-test must keep lifecycle state isolated: %s", needle)
+		}
+	}
+}
+
 func TestInstallPS1OwnsWindowsServiceLoggingAndRecovery(t *testing.T) {
 	content, err := os.ReadFile(repoFile("scripts", "install.ps1"))
 	if err != nil {