[BUG] Cowork: CoworkVMService fails with "signature verification initialization failed: failed to get service executable path" on Windows 11 Pro

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Cowork shows "VM service not running. The service failed to start."
CoworkVMService (type WIN32_PACKAGED_PROCESS) starts and immediately
stops with service-specific error code 1. HCS/HCN initialize
successfully but the service exits on signature verification.

What Should Happen?

CoworkVMService should start successfully and Cowork should be usable.

Error Messages/Logs

[HCS] vmcompute.dll loaded successfully
[HCS] computecore.dll loaded successfully
[HCS] Procs initialized, HCS ready
[HCN] Initialized HCN API from computenetwork.dll
[HCN] EnumerateNetworks result: ["c08cb7b8-9b3c-408e-8e30-5e16a3aeb444"]
Service error: signature verification initialization failed: failed to 
get service executable path: The system cannot find the path specified.

Steps to Reproduce

1. Install Claude Desktop 1.569.0.0 (MSIX) on Windows 11 Pro
2. Open Claude Desktop and click Cowork tab
3. Error: "VM service not running. The service failed to start."

Claude Model

Sonnet (default)

Is this a regression?

No, this never worked

Last Working Version

_No response_

Claude Code Version

N/A (this is Claude Desktop)

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

PowerShell

Additional Information

• Hyper-V enabled (hypervisorlaunchtype Auto confirmed via bcdedit)
• VirtualBox 7.2.6 also installed (but Hyper-V coexistence mode)
• Package registered to correct user (confirmed via Get-AppxPackage -AllUsers)
• cowork-svc.exe binary exists and runs fine when executed directly
• sc.exe and direct binary uninstall/reinstall both blocked ("Access is denied")
• Service type is WIN32_PACKAGED_PROCESS - suspect MSIX sandbox prevents

SCM path lookup needed for signature verification

• Persists across clean reinstall (tested on 1.2.234.0 and 1.569.0.0)