Adopt shared Connect-EXOAdvanced in PublicFolders/Migration/ToMicrosoft365Groups/* scripts

Parent: #2590
Depends on: #2591

Refactor the three root scripts in PublicFolders/Migration/ToMicrosoft365Groups/ to use the shared helper. All three carry the same silent-failure pattern as MailPublicFolderSync, plus they all key their Disconnect-ExchangeOnline cleanup on $script:isConnectedToExchangeOnline — a flag that today is $true even on a failed connect.

Scripts

• PublicFolders/Migration/ToMicrosoft365Groups/AddMembersToGroups.ps1
• PublicFolders/Migration/ToMicrosoft365Groups/LockAndSavePublicFolderProperties.ps1
• PublicFolders/Migration/ToMicrosoft365Groups/UnlockAndRestorePublicFolderProperties.ps1

Problem code (representative)

AddMembersToGroups.ps1#L97-L109 — same pattern in the other two:

function InitializeExchangeOnlineRemoteSession() {
    Import-Module ExchangeOnlineManagement -ErrorAction SilentlyContinue
    if (Get-Module ExchangeOnlineManagement) {
        $connectParams = @{
            ConnectionUri = $ConnectionUri
            Prefix        = "Remote"
            ErrorAction   = "SilentlyContinue"      # 🐛
        }
        if ($null -ne $Credential) { $connectParams.Credential = $Credential }
        Connect-ExchangeOnline @connectParams
        $script:isConnectedToExchangeOnline = $true # 🐛
    } else {
        Write-Warning $LocalizedStrings.EXOV2ModuleNotInstalled
        exit
    }
}

Corresponding cleanup (AddMembersToGroups.ps1#L587-L588):

if ($script:isConnectedToExchangeOnline -and $ArePublicFoldersOnPremises) {
    Disconnect-ExchangeOnline -Confirm:$false -ErrorAction SilentlyContinue
}

Target pseudocode

. $PSScriptRoot\..\..\..\Shared\M365\EXOConnection.ps1

$exo = $null
if ($ArePublicFoldersOnPremises) {
    $exo = Connect-EXOAdvanced -ConnectionUri $ConnectionUri `
                               -AzureADAuthorizationEndpointUri $AzureADAuthorizationEndpointUri `
                               -Credential $Credential `
                               -Prefix 'Remote'
    if (-not $exo) { return }
}

try {
    # ...existing migration logic...
} finally {
    if ($exo) { Disconnect-EXOAdvanced -Connection $exo }
}

Removes:

• InitializeExchangeOnlineRemoteSession function
• $script:isConnectedToExchangeOnline variable
• Manual disconnect block
• EXOV2ModuleNotInstalled localized string

Validation

• New Pester tests per script mocking Connect-EXOAdvanced / Disconnect-EXOAdvanced.
• Lab test: exercise the on-prem PF branch on one script (the only branch that connects to EXO).

Start by reading Shared/M365/EXOConnection.ps1 and the connection and cleanup sections in the three listed scripts under PublicFolders/Migration/ToMicrosoft365Groups/. Add the per-script Pester tests described in the issue, mocking Connect-EXOAdvanced and Disconnect-EXOAdvanced. Done means all three scripts use the shared helper, remove the listed legacy connection state and localized string, and the tests and on-premises lab validation pass.