fix: enforce Network and SMB1 Restore contracts

[man612]

Summary

Tighten selected-network and SMB1 legacy snapshot/Restore contracts so only baselines the tool can legitimately create and exactly restore are accepted.

Gaps reproduced before this fix

Restore validation accepted tampered snapshots with:

• selected-network baseline Private
• selected-network baseline DomainAuthenticated
• SMB1 baseline Unknown
• SMB1 baseline Enabled

The Windows SMB feature state enum on the live Windows 11 audit host also includes DisablePending, Superseded, PartiallyInstalled, and DisabledWithPayloadRemoved. The current Restore logic cannot guarantee exact rollback for those states.

Fix

• selected-network snapshot creation requires a Public baseline
• selected-network Restore validation requires a Public baseline
• SMB1 legacy snapshot creation requires an exactly Disabled baseline
• SMB1 Restore validation accepts only exact Disabled for the legacy enable action
• SMB1 Enabled / EnablePending remain no-op states that preserve Restore history
• SMB1 Unknown, DisablePending, Superseded, PartiallyInstalled, and DisabledWithPayloadRemoved abort before snapshot/mutation because exact rollback is not guaranteed

Regression coverage

Adds tests/NetworkSmbRestoreContractSmoke.ps1 covering:

• valid Public network baseline creation + validation
• transactional rejection of Private/DomainAuthenticated network baselines
• rejection of tampered Private/DomainAuthenticated snapshots
• valid exact Disabled SMB1 baseline creation + validation
• snapshot-maker rejection for every observed unsupported SMB1 state
• validator rejection for every unsupported SMB1 state
• legacy execution preflight preventing snapshot/mutation for unsupported SMB1 states

Local Windows PowerShell 5.1 verification

• PSScriptAnalyzer 1.25.0: 0 actionable diagnostics
• PerformanceSmoke: pass
• FirewallRestoreContractSmoke: pass
• NetworkSmbRestoreContractSmoke: pass
• CombinedSafeRepairScopeSmoke: pass
• SafeRepairNoOpSmoke: pass
• LegacyNoOpSmoke: pass
• PointAndPrintSafetySmoke: pass
• RepairOutcomeSmoke: pass
• RepairPostconditionSmoke: pass
• RestoreOutcomeSmoke: pass
• RestoreActionContractSmoke: pass
• ServiceRestoreScopeSmoke: pass
• SnapshotScopeSmoke: pass
• RestoreSafetySmoke: pass
• Validate.ps1: pass

Normal Safe Repair behavior is unchanged; invalid or non-restorable baselines are rejected more strictly.