[Nico77600]

Summary

• Add owner-signed, timestamped PowerShell runtime and a strict raw-file integrity manifest; authenticate bundled code/resources before loading and compile verified C# in memory.
• Preserve existing packaging paths, README, both HTML guides, vendor DLL bytes and the canonical personal-project disclaimer.
• Fix tenant database binding, exact coverage/refresh completeness, source-boundary diagnostics and daylight-saving HTML chronology.
• Add privacy-off-by-default tenant/environment display, independent company branding and generic documentation/regression coverage.

Validation and release

Use the existing offline Pester, analyzer and packaging procedures and the required Validate (PowerShell 7) check. CodeQL remains advisory with the existing manual C# build and pinned Actions.

Publish only a new v2.1.2 and PurviewDlpReport-2.1.2.zip after merge and exact asset verification. Do not replace or retag v2.1.1. Configuration stays editable; there is no unsigned fallback. Startup recompilation/check overhead is documented.