docs: warn against Session 0 and S4U principals on Windows

[Microck]

Windows persistent Hosts only work as the per-user Task Scheduler logon task that setup installs. Nothing in the docs said that, so an operator could reasonably "harden" the task into S4U or a Session 0 service and then debug DXGI failures at 3am.

Documents the interactive-token principal, the must-exist interactive session, and why S4U and Session 0 services are wrong for desktop hosts. Matches the installer behavior, which already pins InteractiveToken plus least privilege and reads the registered definition back on later runs.

Proof: Fumadocs schema-check (12 schema versions) and full docs:build (19/19 pages) green on a Linux box; prose-only change, no CLI surface touched.

Fixes #199.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: 5e217e99-8d8e-4580-907b-16bd437024be

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}