feat: enable Quick Machine Recovery (reagentc) in the online post-install path

[DevSecNinja]

What

Add a post-install step to enable Quick Machine Recovery (QMR) on Windows 11 24H2+ (cloud
remediation + auto remediation), since it is OFF by default on managed/business-defaulted machines.

Why

QMR lets an unbootable machine boot into WinRE, connect, and pull a remediation from Windows Update
automatically (the post-CrowdStrike "recover fleets without a tech" feature). Low-risk safety net;
worth enabling on an opinionated build.

Why it is not a plain catalog entry

QMR has no single registry value — it is configured via reagentc.exe /setrecoverysettings
with an XML payload, against the live WinRE and requires elevation. So it cannot be baked into
the offline image cleanly; it belongs in the elevated online post-install path.

Proposed approach

• Add a private, mockable seam wrapping reagentc.exe (/setrecoverysettings /path <xml>,
  /getrecoverysettings, /enable).
• Generate the WinRE XML enabling CloudRemediation state="1" and AutoRemediation state="1"
  (one-time scan by default; make the retry interval/looped scan configurable).
• Expose as an opt-in switch/flag on Invoke-PostInstallSetup / post-install.ps1
  (e.g. -EnableQuickMachineRecovery), default off.
• Idempotent (read current settings via /getrecoverysettings first), -WhatIf previews the XML
  without applying, elevation required.
• Optionally support Wi-Fi credentials block only if a use case needs it (wired/WPA2 only per docs).
• Tests mock the reagentc seam (already-enabled → AlreadyApplied; disabled → Applied; preview).

References

• https://learn.microsoft.com/windows/configuration/quick-machine-recovery/
• Recovery CSP QuickMachineRecovery (MDM alternative).