fix: WinRM RDP bundle staging in %TEMP% (0.4.14)

Move zip download and extract to user TEMP to avoid ProgramData access denied on DCs. Improve WinRM ERROR line parsing and add optional SAC_AGENT_BUNDLE_BASE_URL for LAN clients.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/tests/test_winrm_connect.py

@@ -11,7 +11,8 @@ from app.services.rdp_bundle_delivery import (
 )
 from app.services.winrm_connect import (
     RDP_BUNDLE_REQUIRED,
-    RDP_REMOTE_STAGING,
+    RDP_LEGACY_STAGING,
+    RDP_REMOTE_STAGING_DIRNAME,
     WinRmCmdResult,
     _clixml_to_plain,
     _custom_deploy_body,
@@ -37,30 +38,40 @@ def test_decode_winrm_bytes_handles_utf8_multibyte():
 
 
 def test_deploy_from_staging_includes_deploy_log_tail():
-    script = _deploy_from_staging_body(RDP_REMOTE_STAGING)
+    script = _deploy_from_staging_body()
     assert "deploy.log" in script
     assert "Get-Content" in script
     assert "-Encoding UTF8" in script
+    assert RDP_REMOTE_STAGING_DIRNAME in script
 
 
 def test_prepare_staging_recreates_remote_dir():
-    script = _prepare_staging_body(RDP_REMOTE_STAGING)
+    script = _prepare_staging_body()
     assert "Remove-Item" in script
-    assert "_sac_staging" in script
+    assert RDP_REMOTE_STAGING_DIRNAME in script
+    assert RDP_LEGACY_STAGING in script
 
 
 def test_download_bundle_uses_invoke_webrequest():
     script = _download_bundle_body(
-        RDP_REMOTE_STAGING,
         "https://sac.example/api/v1/agent/rdp-bundle/token",
     )
     assert "Invoke-WebRequest" in script
+    assert "$env:TEMP" in script
+    assert RDP_REMOTE_STAGING_DIRNAME in script
     assert "ZipFile]::ExtractToDirectory" in script
+    assert "_sac_staging" not in script or RDP_LEGACY_STAGING in script
     assert "Expand-Archive" not in script
 
 
+def test_winrm_failure_detail_prefers_error_line_over_progress_stdout():
+    stdout = "Downloading bundle: https://sac.test/bundle\nERROR: destination not empty"
+    detail = _winrm_failure_detail(stdout, "", 1)
+    assert detail == "destination not empty"
+
+
 def test_deploy_from_staging_runs_local_bundle():
-    script = _deploy_from_staging_body(RDP_REMOTE_STAGING)
+    script = _deploy_from_staging_body()
     assert "-SourceShareRoot" in script
     assert "Deploy-LoginMonitor.ps1" in script