feat: fail post-install when Windows is not activated (activation check)

[DevSecNinja]

What

Add an activation check to the online post-install path (Invoke-PostInstallSetup): after applying
the catalog, verify Windows is activated and fail the run if it is not.

Why

A debloated/opinionated machine should not silently end up unactivated. Surfacing this as a run
failure (with a clear message) makes it obvious during provisioning rather than weeks later.

Proposed approach

• Add a private, mockable seam (e.g. Get-WindowsLicenseStatus) that reads activation state via
  WMI/CIM SoftwareLicensingProduct where PartialProductKey IS NOT NULL, checking
  LicenseStatus (1 = Licensed).
• Add an opt-in switch -RequireActivation on Invoke-PostInstallSetup / post-install.ps1
  (default off so unactivated eval/VM runs are not broken unexpectedly), or a config flag.
• When set and status ≠ Licensed → set Outcome = 'Failed' with a descriptive reason and attach an
  Activation block to the RunReport (status code + human-readable state).
• Honour -WhatIf (report the check that would run, change nothing).
• Unit tests mock the seam for Licensed / Notification / Unlicensed / grace states.

Notes

• Keep it a check only — do not attempt to activate or inject keys (out of scope; product-key
  handling already lives in the autounattend/build path).