Add Phase 2 package policy editor

[Benoît Cortier (CBenoit)]

Summary

• add the Windows-only Agent policy management surface for Active, Missing, and Invalid stores while preserving the Phase 1 read-only inspector and its independence from UseAgentBroker
• add the complete structured and strict raw draft editor with authoritative Agent validation, localized bounded findings, exact warning acknowledgements, and transactional stale-token handling
• add the separately elevated, mutually authenticated NativeAOT policy-write helper with bounded one-shot IPC, fail-closed install-path/signer checks, and release packaging/signing/integrity wiring
• add dirty-lifecycle protection, accessibility/search/localization coverage, and comprehensive editor/management/helper tests

Stack and contract provenance

This PR is stacked on and targets Phase 1: #5292.

• shared contract: Devolutions/now-libraries#99 at ec592a91f95a66c8a79b7d612ed73d931ef74aeb (2026.8.29-phase2.ec592a91)
• Agent/Gateway implementation: Devolutions/devolutions-gateway#1963 at c1b72fe33b36dc1d80d79ee6d8d759d76ef9e275; CI run 33254105745 passed

Validation

• PolicyEditor tests: 196 passed
• AgentBroker policy management/elevation tests: 238 Windows-target and 128 portable-target passed
• UniGetUI.Windows.slnx x64 build: succeeded
• forced net10.0 portable Avalonia compile: succeeded
• win-x64 NativeAOT app and helper publish: succeeded
• published UniGetUI.exe: 62,398,976 bytes
• staged Assets\Utilities\UniGetUI.PolicyElevator.exe: 5,754,368 bytes
• no policy/editor/helper trim or AOT warnings; remaining IL warnings are pre-existing Avalonia DataGrid internals
• integrity-tree validation covered both executables
• translation validation and git diff --check: clean

External gates

• local win-arm64 NativeAOT publication requires the Visual Studio C++ ARM64 build tools that are not installed on this machine; the checked-in ARM64 CI/project configuration remains enabled
• real UAC cancellation, mutual Authenticode signer binding, and elevated Agent replacement scenarios require app/helper binaries signed together by the release signer and a compatible running Agent

This remains a draft stacked PR. It does not publish, merge, or change readiness of either dependency.