dotfiles: let the group read the kernel logger ACL it was granted

dotfiles: let the group read the kernel logger ACL it was granted

The rights mask handed to EventAccessControl was 0x0FE1 -- the WMI and TRACELOG
rights and nothing else.  The SYSTEM and Administrators entries on that GUID
carry 0x120FFF, and the missing 0x120000 is READ_CONTROL and SYNCHRONIZE:
without READ_CONTROL the group cannot read back the descriptor it was just
added to, so EventAccessQuery answers "access denied" whether or not the grant
landed, which makes it useless as the one cheap probe available from the
unelevated account.  Now 0x120FE1.

Also corrected, in the step and the README: the ACE is machine state, and a
logon does nothing for it.  ETW reads these descriptors into a cache, so a
reboot is what is expected to put it into effect -- the ACE is in the descriptor
(D:...(A;;0xfe1;;;LU)) and xperf -on base is still denied from a fresh shell on
the running system.  A first run therefore wants both: a new logon for the group
membership and the privilege, a reboot for this.

Not yet confirmed: whether the reboot is in fact sufficient.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YMh8i2QzkHNdE3MkKfcaT6