feat(intune): implement Windows device compliance evidence module (#364)

[Copilot]

Implements cmtraceopen_parser::intune::device::windows::compliance — the pure-Rust, wasm32-compatible analyzer for Intune Windows device compliance evaluation and reporting evidence. The core invariant: Conditional Access denials, stale cloud state, and missing user evaluations are distinct phases that cannot produce local setting verdicts.

Module structure

File	Purpose
models.rs	Four-phase typed model: local evaluation → aggregate → reporting → access
sources.rs	Envelope decoding + event/report classification into typed signals
reducer.rs	Strict phase-by-phase reduction; findings derived from the finished snapshot only
rules.rs	Conservative finding derivation; access-only findings capped at Low/Info
redaction.rs	Deterministic privacy projection via FNV-1a keyed tokens

Bugs fixed from pre-merge audit (recovery branch)

10 correctness defects corrected before landing:

• Source eligibility — classify_event/classify_setting_report now gate on parse_state == Parsed and access_state == Available; unrelated-provider records can no longer produce compliance states
• Atomic decode — StagedRecords accumulates all records before touching ComplianceInput; a mid-array parse failure no longer leaves partially-decoded state
• Access timestamp kind — normalized_timestamp rejects Local/Unspecified/Invalid timestamps; only Utc and Offset are usable for correlation ordering
• Identity linkage — removed the device-context fallback from keys_match; a service record with no declared identity no longer matches every access decision
• Vacuous coverage — push_device_compliant uses !coverage.is_empty() && .all(Available) so an empty evidence set cannot produce High confidence
• Reporting chronology — Submitted overrides Failed; a successful retry is no longer hidden by an earlier failure
• 64-bit hex — error-code hex form derived from original digits, not via as u32 truncation
• Synthetic timestamp kind — Offset vs Utc set by inspecting whether the raw string ends with Z
• Mask key — is_already_masked_token validates exact [kind:16hexdigits] shape; bracket-wrapped raw identifiers can no longer bypass redaction
• Contradiction text — finding summary no longer asserts "no verdict was chosen" for settings that do have a verdict

Fixture matrix

All 16 required scenarios from issue #364:

local-compliant-service-compliant
local-noncompliant-setting
evaluation-error
unsupported-not-applicable-setting
local-compliant-stale-service-noncompliant
local-noncompliant-with-later-service-update
user-targeted-policy-not-evaluated
custom-compliance-discovery-noncompliant
custom-compliance-script-failure
report-submission-failure
access-denied-with-matching-state
access-denied-without-compliance-evidence
partial-event-and-report-coverage
contradictory-ids-and-timestamps
malformed-and-unknown-schema
deterministic-privacy-redaction

• Fixes Intune Windows device: model compliance evaluation and reporting evidence #364

[adamgell]

Superseded by restack onto current main: https://github.com/adamgell/cmtraceopen/pull/$(gh pr list --head staff/intune-364-compliance-lane-b-r1 --json number -q '.[0].number')

Reason: this branch was ~463 commits behind main; the only CI failure (pure_module_cannot_collect_and_stays_wasm_clean / company-portal redaction) is fixed on main and unrelated to the compliance leaf. Module + fixtures were ported cleanly without force-pushing this branch.

[adamgell]

Superseded by merged #495 on main.