docs(windows): correct the handoff comments after dropping the pipe

The cleanup handle is no longer held through the UAC prompt, and the files
stay protected by their DACLs together with the parent directory's
permissions, not by the DACL alone. Describe the F-Secure failure as what
was observed: cmd's end of the pipe closed before the release signal.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JAxkkiaGp2k8okvs4MpCUq

src/platform/windows/installer_files.rs

@@ -151,7 +151,7 @@ fn create_protected_file(path: &Path) -> ResultType<File> {
 
 fn duplicate_cleanup_handle(file: &File) -> ResultType<Owned<HANDLE>> {
     let mut handle = HANDLE::default();
-    // Retain deletion capability, not a writable handle, while waiting for UAC.
+    // Retain deletion capability, not a writable handle, until the files are released to cmd.
     unsafe {
         let process = GetCurrentProcess();
         DuplicateHandle(

src/platform/windows/installer_handoff.rs

@@ -100,8 +100,9 @@ pub(super) fn run_cmds(cmds: impl Into<InstallCommands>, show: bool, tip: &str)
     directory::create(&directory)?;
     // cmd cannot open the BAT or copy its inputs while a DELETE-capable handle is open, so
     // close them before launching it; a cancelled UAC prompt then leaves the files behind.
-    // Holding them until cmd read a release signal from a named pipe made F-Secure's
-    // behavior detection end the elevated cmd (#16840, #16842). The DACL still protects them.
+    // Holding them until cmd read a release signal from a named pipe failed under F-Secure's
+    // behavior detection, which closed cmd's end first (#16840, #16842). The file DACLs and
+    // the parent directory's permissions still keep unelevated users from changing them.
     script.release_files();
     let process = launch_elevated(&cmd_path, &parameters, show).map_err(|err| {
         log::debug!("Failed to launch elevated installer: {err:#}");