⚠ Run virus to capture its code
This briefly runs one infected file (a few seconds, in a locked sandbox that is force-killed after)
so we can capture the virus's decrypted code and build the repair.
Only do this on an isolated test VM — take a VM snapshot first, and restore it afterward.
Never on a work computer.