fix: use locale-neutral Windows ACL for build data (#3887)

On localized Windows installations, `build_data_writer.ps1` could fail
when
creating the output file ACL because it used the English localized
`Everyone`
principal name.

This changes the ACL rule to use the language-neutral `WorldSid`
identity
instead, preserving the existing Everyone read permission without
depending on
the display language of Windows.

Before: German and other localized Windows installs could fail with
`IdentityMappedException` / `IdentityNotMappedException`.

After: build data generation succeeds on localized Windows installs.

Fixes #3886

Tests:
`bazelisk test //tests/build_data:build_data_test --config=fast-tests`

---------

Co-authored-by: Richard Levasseur <richardlev@gmail.com>
(cherry picked from commit 8629003966d56fff8c919d7c9dc191bae9715c9e)

Work towards #3867

CHANGELOG.md

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0e91608..d585ce8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -54,6 +54,7 @@
 * (rules) Fixed venv output paths for `py_binary` and `py_test` targets whose
 names contain path separators so distinct targets with the same basename no
 longer share the same venv output directory.
+* (windows) Fixed build data generation on localized Windows installations.
 
 {#v2-2-0-added}
 ### Added
@@ -76,6 +77,7 @@
 
 
 
+
 {#v2-1-0}
 ## [2.1.0] - 2026-06-17
 

python/private/build_data_writer.ps1

diff --git a/python/private/build_data_writer.ps1 b/python/private/build_data_writer.ps1
index 0074e69..05c49fe 100644
--- a/python/private/build_data_writer.ps1
+++ b/python/private/build_data_writer.ps1
@@ -21,7 +21,16 @@
 [System.IO.File]::WriteAllLines($OutputPath, $Lines, $Utf8NoBom)
 
 $Acl = Get-Acl $OutputPath
-$AccessRule = New-Object System.Security.AccessControl.FileSystemAccessRule("Everyone", "Read", "Allow")
+# We use WorldSid because the "Everyone" name is locale-dependent.
+$EveryoneSid = New-Object System.Security.Principal.SecurityIdentifier(
+    [System.Security.Principal.WellKnownSidType]::WorldSid,
+    $null
+)
+$AccessRule = New-Object System.Security.AccessControl.FileSystemAccessRule(
+    $EveryoneSid,
+    "Read",
+    "Allow"
+)
 $Acl.SetAccessRule($AccessRule)
 Set-Acl $OutputPath $Acl