Roll back the modules' registry writes on a failed apply (Scope B)

[BiosSystem]

What

Completes full-module rollback. Scope A (merged in #45) reverted the modules' non-registry state on a failed apply but reported their imperative registry writes as "not restored". Scope B closes that gap for the three registry-writing modules: SecurityHardening, ExtendedAIPurge, GamingMode.

Design (as agreed: expose write targets as data so the snapshot can't drift)

• Each module gets Get-<Module>RegistryTargets returning the exact (Path, Name) values it writes.
• BackupModuleState snapshots each target's current value and type before apply (or records absence).
• On rollback it writes the original back with its type, or removes a value the module created. Restoring all captured targets is safe even for a module that didn't run, since they were captured pre-apply.
• One-way ops (Recall component removal) and the powercfg power-plan change stay reported as not restored. GamingMode's per-interface Nagle values are enumerated at capture time.

Validation

• Tests\Invoke-StaticValidation.ps1 -RequirePSScriptAnalyzer clean (122 files).
• Full unit suite: 167 passed, 0 failed, including new Scope B coverage — restore-existing-value, remove-created-value, skip-when-no-registry-module, failure recorded not faked; provider contents; and an AST drift guard asserting every Set-ItemProperty name in each module is declared by its provider.
• Smoke-tested the live registry-read path (read-only) on a real machine: providers return 11 / 16 / 41 targets (41 = 9 static + 16 interfaces × 2), correct value/type read and missing-value detection.
• Also wired Test-ModuleRollback.ps1 and Test-ConfigConsistency.ps1 into CI — both existed but were never run there.

Not run here (mutating, needs Sandbox): the live capture-apply-fail-restore cycle against the real registry. The snapshot/restore logic and the real read path are covered as above.