[Task]: wingetbot worker — Installer/unattended-install class learnings

### Description

Per-class learning tracker for the **wingetbot auto-update PR triage worker** (#411124). Capture evidence and heuristics for the **Installer execution / unattended-install** class here.

**Labels:** `Validation-Unattended-Failed`, `Validation-Installation-Error`, `Validation-Executable-Error`, `Validation-Shell-Execute`

### Current disposition (from the 2026-08-01 pilot)

**Diagnose + route — frequently a moderator call.** The installer won't install silently; it needs switches, exit-code mapping, or a waiver.

### Learnings so far

- Examples: #410251 (MetaGeek.inSSIDer), #410264 (Webroot.SecureAnywhere), #410655 (Cfx.re.FiveM), #410652 (Caphyon.PacKit — `Validation-Shell-Execute`).
- These are often not author-fixable in a simple way (portable/zip CLI false-positives, interactive-only installers, or missing `Silent`/`SilentWithProgress` switches).
- Evidence lives in the ADO validation log (the `Installation Validation` / backend result), not a PR comment.

### Open questions / learnings to capture

- [ ] Can the worker read a specific, actionable failure reason from the ADO log (missing silent switch vs. non-zero exit vs. interactive-only)?
- [ ] Which sub-cases are safely suggestable (e.g. add `InstallerSwitches.Silent`) vs. pure moderator-waiver territory?
- [ ] Overlap with the security bucket — ensure hard-abort still applies if a security label co-occurs.

Parent: #411124

_Created with GitHub Copilot assistance._

Start with parent #411124, the listed example issues, and their ADO Installation Validation/backend results. Compare missing silent-switch, non-zero-exit, interactive-only, and security-label cases; done means recording actionable worker heuristics and clarifying which cases route to moderators or waivers.

Written by the indexing model from the issue text.