fix: enforce firewall Restore action contract

[man612]

Summary

Tighten Restore validation for firewall Safe Repair snapshots so tampered or impossible firewall action state cannot reach mutation.

Gaps reproduced before this fix

Restore validation accepted:

• an Enable sharing firewall rules snapshot with zero firewall entries
• an Enable sharing firewall rules snapshot containing only a Public-profile sharing rule
• a combined Safe Repair snapshot containing Public-only firewall state

Normal Safe Repair does not mutate Public-only rules, so those snapshots were outside the action's real mutation contract.

Fix

• firewall-only snapshot creation now requires at least one managed Domain/Private/Any rule after filtering
• failed/empty firewall-only snapshot creation remains transactional and preserves the previous Restore pointer
• firewall-only Restore validation requires at least one firewall entry
• firewall state for firewall Safe Repair / combined Safe Repair must be within Domain/Private/Any profile scope
• Public-only firewall state is rejected before Restore confirmation/mutation
• valid Private/Domain firewall snapshots remain accepted

Regression coverage

Adds tests/FirewallRestoreContractSmoke.ps1 covering:

• transactional rejection of Public-only snapshot creation
• rejection of empty firewall-only tampered state
• rejection of Public-only firewall-only state
• rejection of Public-only state inside combined Safe Repair
• acceptance of a valid Private firewall snapshot

Local Windows PowerShell 5.1 verification

• PSScriptAnalyzer 1.25.0: 0 actionable diagnostics
• FirewallRestoreContractSmoke: pass
• CombinedSafeRepairScopeSmoke: pass
• SafeRepairNoOpSmoke: pass
• LegacyNoOpSmoke: pass
• PointAndPrintSafetySmoke: pass
• RepairOutcomeSmoke: pass
• RepairPostconditionSmoke: pass
• RestoreOutcomeSmoke: pass
• RestoreActionContractSmoke: pass
• ServiceRestoreScopeSmoke: pass
• SnapshotScopeSmoke: pass
• RestoreSafetySmoke: pass
• Validate.ps1: pass

The normal firewall repair surface is unchanged; invalid Restore input is rejected more strictly.