dotfiles: keep the group membership, drop the grants that bought nothing

dotfiles: keep the group membership, drop the grants that bought nothing

The NT Kernel Logger is reserved for Administrators and LocalSystem, and no
amount of permission granting reaches it.  Measured on this box, all three in
place at once and across a reboot -- the account in Performance Log Users,
SeSystemProfilePrivilege granted to that group, and an explicit ACE giving the
group TRACELOG_ACCESS_KERNEL_LOGGER on SystemTraceControlGuid, confirmed present
in the descriptor afterwards:

    xperf -on base            -> NT Kernel Logger: Access is denied. (0x5)
    wpr -start GeneralProfile -> Access is denied. (0x80070005)

It is not a check an ACE overrides, and Microsoft documents Performance Log
Users access as explicitly not extending to that session.  So the privilege
grant and the ACE go, along with the LSA and EventAccessControl interop that
existed only to apply them -- roughly 280 lines, in a script that was getting
long enough to notice.

What stays is the part that works, and it does work: membership in Performance
Log Users lets the account create and control ordinary ETW sessions, verified
unelevated after the reboot --

    xperf -start T -on Microsoft-Windows-Kernel-Process -f trace.etl   -> exit 0

which was Access denied before.  Enough to trace an application's own providers
without a UAC prompt.  Kernel and CPU-sampling traces are elevated work now, run
deliberately with xperf, wpr or VTune from an Administrator prompt.

The step and the README keep the negative result rather than quietly dropping
it: it is a plausible-looking path that does not work, and the next person to
try deserves to be told where it ends.  The README also says how to undo the two
grants on a box that ran the earlier revision -- they are still applied here.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YMh8i2QzkHNdE3MkKfcaT6