[Manish Ranjan Mahanta (marma-dev)]

Summary

• Emit sidecar GCS diagnostics through a dedicated Microsoft.Virtualization.GCSSidecar ETW provider using the existing etwlogrus hook.
• Keep emission disabled until the validated confidential policy permits allow_runtime_logging; reuse existing Log Forward Service provider policy for collection without adding a new permission.
• Include the provider in default collection at Information level and merge provider-name/GUID case variants without duplicate subscriptions.

Validation performed

• Changed-package Windows suites, targeted Rego logging-policy tests, Go vet, sidecar/host builds, and Linux shared-policy test cross-compilation passed.
• Live VBS C-WCOW with Secure Boot enabled confirmed sidecar forwarding and continued host parsing with the timestamp fix in Handle formatting markers in forwarded ETW timestamps #2981. Runtime logging denied: zero sidecar events while other providers continued forwarding.
• Fixed case-insensitive overrides and added canonical/lowercase/uppercase name and GUID regression coverage; provider and sidecar suites passed, and CI-pinned golangci-lint reported zero issues.
• Ordinary non-confidential WCOW (NanoServer LTSC 2025, guest 10.0.26100.33674) booted with default options, confirmed SIDECAR_ABSENT, and completed its guest command with exit code 0.
• Separately tested active Log Forward Service collection on the stock 10.0.28000.2178 VBS guest with the new provider absent and its canonical GUID requested: 216 events from other providers continued forwarding without a UVM startup failure.

Compatibility and coverage notes

• Handle formatting markers in forwarded ETW timestamps #2981 fixes the host timestamp parsing issue exposed by live testing and is required for correct consumption of the sidecar events.
• Existing policies using default sources must allow the new provider or enable provider dropping; otherwise existing fail-close behavior may reject UVM startup.
• Ordinary-WCOW startup and active absent-provider collection were validated separately: the LTSC 2025 guest does not advertise Log Forward Service support. An ordinary forwarding-capable WCOW image has not been tested end-to-end.
• The existing launcher output-processing teardown hang and forced-shutdown partial-record diagnostic remain outside this PR; all test UVMs are stopped.

[Justin (jterry75)]

We close on error but dont defer a close on success else. Do we need one?