cmd/drover: UAC re-launch helper for non-admin invocations

CLI subcommands (check/version/update) don't need driver access and
run as user. Bare drover.exe (GUI/engine mode) requires admin for
WinDivertOpen — re-launches via ShellExecute("runas") and exits.

Per spec decision B1: prompt at every launch, no scheduled-task
trampoline.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

cmd/drover/uac_windows.go

@@ -0,0 +1,87 @@
+//go:build windows
+
+package main
+
+import (
+	"os"
+	"syscall"
+	"unsafe"
+
+	"golang.org/x/sys/windows"
+)
+
+// IsAdmin returns true when the current process token has elevation.
+// Wraps GetTokenInformation(TokenElevation).
+func IsAdmin() bool {
+	var token windows.Token
+	if err := windows.OpenProcessToken(windows.CurrentProcess(), windows.TOKEN_QUERY, &token); err != nil {
+		return false
+	}
+	defer token.Close()
+
+	var elevation uint32
+	var sz uint32
+	err := windows.GetTokenInformation(
+		token,
+		windows.TokenElevation,
+		(*byte)(unsafe.Pointer(&elevation)),
+		uint32(unsafe.Sizeof(elevation)),
+		&sz,
+	)
+	if err != nil {
+		return false
+	}
+	return elevation != 0
+}
+
+// CmdNeedsAdmin reports whether the given CLI args land in a code path
+// that requires a WinDivert handle (and therefore admin). The default
+// (no args = GUI mode) needs admin; explicit subcommands like check,
+// version, update do not.
+func CmdNeedsAdmin(args []string) bool {
+	if len(args) == 0 {
+		return true // bare drover.exe → GUI/engine
+	}
+	switch args[0] {
+	case "check", "version", "--version", "-v", "update", "--help", "-h", "help":
+		return false
+	default:
+		return true
+	}
+}
+
+// ReElevate re-launches the current executable with the given args via
+// ShellExecuteW("runas", ...). On success the caller should os.Exit(0)
+// immediately. Returns nil even when the user cancels UAC — the caller
+// can't distinguish; we just exit cleanly afterward.
+func ReElevate(args []string) error {
+	exe, err := os.Executable()
+	if err != nil {
+		return err
+	}
+	verb, _ := syscall.UTF16PtrFromString("runas")
+	exePtr, _ := syscall.UTF16PtrFromString(exe)
+
+	var paramsPtr *uint16
+	if len(args) > 0 {
+		// Quote each arg in case of spaces.
+		quoted := make([]string, len(args))
+		for i, a := range args {
+			quoted[i] = `"` + a + `"`
+		}
+		joined := ""
+		for i, q := range quoted {
+			if i > 0 {
+				joined += " "
+			}
+			joined += q
+		}
+		paramsPtr, _ = syscall.UTF16PtrFromString(joined)
+	}
+
+	cwd, _ := os.Getwd()
+	cwdPtr, _ := syscall.UTF16PtrFromString(cwd)
+
+	// SW_NORMAL = 1
+	return windows.ShellExecute(0, verb, exePtr, paramsPtr, cwdPtr, 1)
+}