feat(investigations): ✨ Add captured endpoint diagnostics and offline triage

[PrzemyslawKlys]

Captured endpoint logs and device-registration output can now be retained, inspected, replayed, and reported through the existing investigation workflow.

• Read bounded CMTrace/plain-text batches with source coordinates, explicit time quality, and resumable checkpoints; interpret numeric errors using their declared HRESULT, Win32, MSI, or process-exit context.
• Reconstruct attributable Intune application attempts and explain captured dsregcmd /status evidence, preserving unknown context and incomplete inputs.
• Copy and hash original artifacts into investigation sessions, verify replayed evidence, and expose the workflow through thin PowerShell/CLI commands and offline HTML reports. Raw log and DSReg fields are excluded from reports by default; identifiers and conclusions can still be sensitive.

evx investigation create --directory .\Case-001 --log .\AppWorkload.log --dsreg .\dsreg-status.txt --expected-join Hybrid --html .\Case-001.html
evx investigation replay --directory .\Case-001 --html .\Case-001-replay.html

The reusable implementation lives in EventViewerX; reporting uses the existing HtmlForgeX components. This adds no production dependencies and preserves native Windows-event investigation behavior. See Docs/Endpoint-Investigations.md for capture context, integrity, and correlation limits.

Validation: 42 endpoint contract cases pass on .NET 8 and .NET 10; all four core/PowerShell targets and the CLI build pass. Actual generated-module capture/open/replay and 13 command contracts pass on PowerShell 5.1 and 7; CLI capture/replay/checkpoint resume and representative browser report states were exercised. Four CLI regressions pass on PowerShell 5.1 and 7 and verify source preservation for checkpoint aliases and ordinary resume; a Windows junction-alias smoke check also preserves the input. An independent read-only review and targeted confirmation informed the regression fixes. Proof uses synthetic captures and existing event fixtures; no live Intune deployment was tested.

The initial full .NET 10 run had 1,638 passing tests and one existing native provider-resource archiving failure, reproduced on unchanged master. The independent correction in #151 establishes its elevation prerequisite and improves error diagnostics; the combined candidate has 1,638 passing tests, zero failures, and the administrator-only archive group validated separately in elevated runs.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-09T13:43:18.363802Z	391480c	PR opened
🔒 Security Review	✅ Completed 2026-10-09T13:42:31.187292Z	391480c	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 391480c2b7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".