Expose AppInstallManager per-app and all-app update searches

Parent: #232

Dependencies and access restriction

Depends on #234 and #236 for the initial approved subset. The blanket access gate in #233 is cleared only for caller-scoped all-app search using SearchForAllUpdatesAsync(correlationVector, clientId, AppUpdateOptions), with AutomaticallyDownloadAndInstallUpdateIfFound=false and AllowForcedAppRestart=false.

Per-app variants, ForUser overloads, automatic download/install and forced restart remain gated on explicit validation and approval. The observed search returned zero items; nonempty results and actual paused-queue transitions still require controlled coverage. Do not claim the full API family is delivered until deferred variants are resolved or split into explicit follow-ups.

Evidence: host/getter matrix and authorized caller-scoped search. This is empirical runtime evidence, not an official third-party support guarantee.

Microsoft documents AppInstallManager access as protected by a private capability restricted to Microsoft-developed apps. Do not bypass that restriction or treat runFullTrust/admin access alone as sufficient.

API scope

SearchForUpdatesAsync, SearchForUpdatesForUserAsync, SearchForAllUpdatesAsync, SearchForAllUpdatesForUserAsync and AppUpdateOptions.

Acceptance criteria

• Deliver the approved caller-scoped all-app paused-only mode first, with typed returned item/request identities. Retain the broader per-app and specified-user modes as gated scope; do not silently expose or substitute them.
• Verify and document the real side effects of each supported overload. In particular, AutomaticallyDownloadAndInstallUpdateIfFound and forced restart must be explicit, never hidden defaults of a supposedly read-only search.
• Setting AutomaticallyDownloadAndInstallUpdateIfFound=false still adds discovered updates to the install queue in a paused state, per the official property-value documentation. Treat this as a queue mutation, not a read-only mode. Require ShouldProcess for the search even with automatic download/install disabled; WhatIf must not invoke it. Do not offer a pure read-only search unless a different documented API can guarantee that behavior.
• Gate every potentially mutating invocation with ShouldProcess; -WhatIf must not start downloads, installs or forced restarts.
• Support documented catalog/correlation/options inputs and per-member version gates. Do not substitute a different user or broader all-app search on failure.
• Cover empty results, grouped/multiple items, supported/unsupported options, search errors, cancellation and accepted-versus-completed outcome semantics.

Shared delivery requirements

Follow the parent epic's compiled-C# contract, user-scope and capability/version gates. Include deterministic Pester 6.2+ coverage, comment-based help, public documentation and unreleased notes in the same implementation PR. Use fail-closed fake adapters for side effects; no real installs, entitlement grants or settings changes in CI. Preserve original errors and distinguish unavailable, unknown, requested and completed outcomes.

Documented API references

• https://learn.microsoft.com/uwp/api/windows.applicationmodel.store.preview.installcontrol.appinstallmanager.searchforupdatesasync
• https://learn.microsoft.com/uwp/api/windows.applicationmodel.store.preview.installcontrol.appinstallmanager.searchforupdatesforuserasync
• https://learn.microsoft.com/uwp/api/windows.applicationmodel.store.preview.installcontrol.appinstallmanager.searchforallupdatesasync
• https://learn.microsoft.com/uwp/api/windows.applicationmodel.store.preview.installcontrol.appinstallmanager.searchforallupdatesforuserasync
• https://learn.microsoft.com/uwp/api/windows.applicationmodel.store.preview.installcontrol.appupdateoptions

Start with the documented AppInstallManager methods—especially SearchForAllUpdatesAsync—and AppUpdateOptions, then review parent #232 and dependencies #234 and #236 for the approved scope. Confirm the caller-scoped paused-only behavior, ShouldProcess and WhatIf semantics, version and capability gates, and deterministic Pester coverage; done means the approved mode is documented without exposing gated variants.