Expose AppInstallManager applicability and installation-policy checks

Parent: #232

Dependencies and access restriction

Depends on #233, #234. Implementation remains blocked until the supported-access gate and listed prerequisites are complete.

Microsoft documents AppInstallManager access as protected by a private capability restricted to Microsoft-developed apps. Do not bypass that restriction or treat runFullTrust/admin access alone as sufficient.

API scope

Applicability, app installation permission, package-identity permission and Store policy queries, including documented ForUser variants.

Acceptance criteria

• Provide a compiled query contract with explicit check kind, exact documented identity inputs and user scope.
• Preserve applicability, permission and policy-blocked answers as distinct results; do not invert IsStoreBlockedByPolicyAsync or collapse all answers into an ambiguous success flag.
• Access denial, unavailable APIs, invalid identity, timeout and cancellation are errors/unknown outcomes, not boolean false or permission to proceed.
• Return the queried identity, scope, check kind and native answer, with supported correlation inputs and version gates.
• No installation, entitlement acquisition, policy modification, elevation or account impersonation as a side effect of a check.

Shared delivery requirements

Follow the parent epic's compiled-C# contract, user-scope and capability/version gates. Include deterministic Pester 6.2+ coverage, comment-based help, public documentation and unreleased notes in the same implementation PR. Use fail-closed fake adapters for side effects; no real installs, entitlement grants or settings changes in CI. Preserve original errors and distinguish unavailable, unknown, requested and completed outcomes.

Documented API references

• https://learn.microsoft.com/uwp/api/windows.applicationmodel.store.preview.installcontrol.appinstallmanager.getisapplicableasync
• https://learn.microsoft.com/uwp/api/windows.applicationmodel.store.preview.installcontrol.appinstallmanager.getisapplicableforuserasync
• https://learn.microsoft.com/uwp/api/windows.applicationmodel.store.preview.installcontrol.appinstallmanager.getisappallowedtoinstallasync
• https://learn.microsoft.com/uwp/api/windows.applicationmodel.store.preview.installcontrol.appinstallmanager.getisappallowedtoinstallforuserasync
• https://learn.microsoft.com/uwp/api/windows.applicationmodel.store.preview.installcontrol.appinstallmanager.getispackageidentityallowedtoinstallasync
• https://learn.microsoft.com/uwp/api/windows.applicationmodel.store.preview.installcontrol.appinstallmanager.getispackageidentityallowedtoinstallforuserasync
• https://learn.microsoft.com/uwp/api/windows.applicationmodel.store.preview.installcontrol.appinstallmanager.isstoreblockedbypolicyasync

Start with parent #232 and dependencies #233 and #234, then review the documented AppInstallManager API references and the supported-access, capability, and version gates. Define the compiled-C# query contract for applicability, permissions, and Store policy checks, including ForUser variants and distinct unknown/error outcomes. Done means deterministic Pester 6.2+ coverage, comment-based help, public documentation, unreleased notes, and fail-closed fake adapters without installation or policy side effects.