Address review follow-up on WSLContainerRegistryAllowlist policy

[beena352]

Summary of the Pull Request

Follow-up to #41211 addressing review nits: open the allowlist sub-key directly, throw an "invalid policy" error at the read site, and tighten build-block test assertions to full-message pattern match.

PR Checklist

• Closes: Follow-up to Add registry allowlist support to image builds #41211
• Communication: I've discussed this with core contributors already. If work hasn't been agreed, this work might be rejected
• Tests: Added/updated if needed and all pass
• Localization: All end user facing strings can be localized
• Dev docs: Added/updated if needed
• Documentation updated: If checked, please file a pull request on our docs repo and link it here: #xxx

Detailed Description of the Pull Request / Additional comments

• ReadRegistryAllowlistSnapshotFromPoliciesRoot now opens the WSLContainerRegistryAllowlist sub-key directly in a single RegOpenKeyExW, then passes it to ReadRegistryAllowlistSnapshot(HKEY subKey)
• Invalid-policy failure is thrown at the read site with MessageRegistryAllowlistPolicyInvalid instead of translated later in BuildImage
• PolicyTests.cpp build-block assertions replaced with VerifyPatternMatch on the exact BuildKit denial line

Validation Steps Performed

[Copilot]

Pull request overview

This PR is a follow-up to the earlier registry allowlist enforcement work, refining how the WSLContainerRegistryAllowlist policy is read and improving the corresponding PolicyTests assertions for BuildKit denial output.

Changes:

• Refactors allowlist snapshot reading to open the allowlist sub-key directly from the policies root.
• Updates policy tests to assert BuildKit denial output via wildcard pattern matching (explicit vs implicit alpine reference).
• Simplifies snapshot logic testing to exercise the “from policies root” path.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
test/windows/PolicyTests.cpp	Tightens build-block test assertions to match the full BuildKit denial line using VerifyPatternMatch, and consolidates allowlist snapshot tests around the “from policies root” helper.
src/windows/inc/wslpolicies.h	Refactors allowlist snapshot reading to take the allowlist sub-key directly and opens that sub-key in one RegOpenKeyExW call from HKLM.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.