Fix WS2025 baselines and Machine Configuration MOF export

[ABMFST]

Summary

• preserve all WS2025 Member/DC/Workgroup controls at 320/321/296 resources
• canonicalize Registry REG_* contracts and hive paths
• replace five CSP controls with Registry providers and switch five remaining CSP controls to writable Config paths
• translate existing compliance schemas to CEL expressions without changing resource order or desired values (except the reviewed FullPrivilegeAuditing binary encoding)
• harden MOF export for Machine Configuration packaging with portable module metadata, correlation groups, typed values, and empty-string fallback

Validation

• static name/order/value/count parity for all three profiles
• ConfigForge parser/platform validation for all three profiles
• full Server 2025 Test-wrapper audits: 320/320, 321/321, and 296/296 readable with zero execution errors
• Workgroup full apply exits 0; exact post-apply audit 296/296 compliant
• Machine Configuration package contains and evaluates all 296 resources
• Azure package upload, policy definition, assignment, guest assignment, and 296-resource package flow exercised on LAPS1
• targeted Vitest: 37 passed
• public packaging guards: 8 passed

Known upstream limitation

Microsoft.OSConfig 1.3.11 audits packages successfully but has an upstream Set() serialization defect; public docs default to Audit until a fixed module is available.

[Copilot]

Pull request overview

This PR rebuilds the Windows Server 2025 baseline overlays and updates ConfigForge’s Machine Configuration MOF export so the exported MOFs are portable for packaging while still supporting typed remediation.

Changes:

• Reworks WS2025 baselines to preserve resource counts/order, canonicalize Registry contracts (REG_*, hive paths), and represent prior compliance schemas as CEL expressions.
• Hardens Machine Configuration MOF export with portable module metadata (ModuleVersion = "0.0.0"), correlation groups, and explicit typed Value fields.
• Updates tests and docs to lock in WS2025 baseline invariants and document the new MOF packaging flow.

Reviewed changes

Copilot reviewed 6 out of 9 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
public/_baselines/ws2025-workgroup-member.osc.yaml	Large WS2025 workgroup overlay rewrite: registry canonicalization + schema→CEL conversion + CSP→Registry/provider swaps.
packages/core/src/import-export/index.ts	MOF export enhancements: UUID/correlation group, portable module version placeholder, typed Value fields, and value extraction logic.
packages/core/src/import-export/index.test.ts	Extends MOF export regression coverage for module binding, correlation grouping, and typed Value behavior.
docs/src/user-guide/manifest-editor.md	Updates packaging instructions to resolve ModuleVersion = "0.0.0" before New-GuestConfigurationPackage and to default to Audit mode.
docs/src/changelog.md	Adds an Unreleased entry summarizing WS2025 baseline rebuild and MOF export changes.
CHANGELOG.md	Adds an Unreleased “Fixed” entry for WS2025 baseline rebuild + MOF export portability changes.
apps/desktop/src/data/baseline-catalog.test.ts	Adds invariants/tests to ensure WS2025 overlays preserve counts, uniqueness, expression-only wrappers, and writable CSP path usage.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 9 changed files in this pull request and generated no new comments.