fix: narrow combined Safe Repair snapshot scope

[man612]

Summary

Make combined Safe Repair snapshots contain only the service and firewall state the action actually plans to mutate.

Bugs reproduced before this fix

With real New-RestoreSnapshot output:

• firewall snapshot captured FPS-Ready,FPS-Fix while only FPS-Fix needed repair
• service snapshot captured Spooler,fdPHost,FDResPub while only Spooler would be changed when discovery services were already Running

That allowed later Restore to roll back managed state the combined action had never changed.

Fix

• add action-contract support for an allowed service subset
• combined Safe Repair requires Spooler in its service snapshot because Spooler is always restarted
• fdPHost / FDResPub are included only when they are not already Running
• firewall snapshot contains only rules that actually need Enabled=True + Domain/Private
• firewall mutation is skipped entirely when no rule needs repair
• if firewall read/write cmdlets are unavailable, combined repair continues with service repairs and snapshots no firewall state
• Restore validation accepts only contract-allowed combined service subsets and still requires Spooler

Regression coverage

Adds tests/CombinedSafeRepairScopeSmoke.ps1 covering:

• mixed service/firewall state: snapshot exactly matches planned mutations
• already-correct discovery/firewall state: snapshot contains Spooler only and zero firewall rules
• resulting narrowed snapshots pass Restore validation

Local Windows PowerShell 5.1 verification

• PSScriptAnalyzer 1.25.0: 0 actionable diagnostics
• CombinedSafeRepairScopeSmoke: pass
• SafeRepairNoOpSmoke: pass
• LegacyNoOpSmoke: pass
• PointAndPrintSafetySmoke: pass
• RepairOutcomeSmoke: pass
• RepairPostconditionSmoke: pass
• RestoreOutcomeSmoke: pass
• RestoreActionContractSmoke: pass
• ServiceRestoreScopeSmoke: pass
• SnapshotScopeSmoke: pass
• RestoreSafetySmoke: pass
• Validate.ps1: pass

No Safe Repair capability is removed; snapshot scope is made exact.