Stop leaving Appx sideloading policy permanently enabled

[TecharyJames]

Branches from BETA. Independent of #2, #3 and #4, and safe to merge in any order.

The problem

Installing any MSIX through the module wrote AllowAllTrustedApps=1 to both HKLM\SOFTWARE\Policies\Microsoft\Windows\Appx and AppModelUnlock, and never put them back.

Every machine that has installed an MSIX through TecharyGet is left with sideloading permanently enabled, including machines where that policy had been explicitly set to disabled, which the old code silently overwrote. It also did this unconditionally, before establishing whether it was needed — a correctly signed package usually provisions with no policy change at all.

What changed

1. Provision first, as the machine is configured. Touch nothing.
2. Only if that is refused, relax the policy.
3. Restore in a finally, covering the success path, the per-user fallback and the throw.

Restoration is exact rather than "set it back to 0". The prior state of each value is recorded first, then put back:

Prior state	After restore
Key absent	Key removed entirely
Key present, value absent	Only the value removed, key kept
AllowAllTrustedApps=0	Comes back as 0, not deleted

An unrelated value in the same key is left untouched.

Two design points

Push-SideloadPolicy never throws. If it did, the state describing what it had already changed would be lost with it, the caller's finally would have nothing to restore from, and the policy would stay relaxed. Failures are returned through the result object instead.

Pop-SideloadPolicy indexes its list rather than wrapping it in @(). On PowerShell 7.6 / .NET 10, @() over a List[object] throws Argument types do not match, which aborted the restore mid-way and left the policy relaxed. Caught by the round-trip test below. List[string] is unaffected; this is specific to List[object].

Verification

Round trip against a scratch HKCU key covering all three prior states:

WHILE RELAXED:
  NoKey          value=1
  KeyNoValue     value=1
  KeyWithValue   value=1

AFTER RESTORE:
  A no key         key absent                   PASS
  B key,no value   key present, value absent    PASS
  C key,value=0    value=0                      PASS
  B unrelated      Unrelated=42                 PASS untouched

ROUND TRIP: CLEAN

The registry paths are parameters so the round trip is testable without modifying live machine policy.

Coverage limitation: this fixes the leak going forward. Machines already left in the relaxed state by previous runs are not cleaned up by this change.