Add read-only package broker policy inspector - #5292

Summary

• add a Windows-only Administrator entry and dedicated read-only active package-broker policy inspector
• consume BrokerClient.GetPolicy and shared PolicyDocument/PolicyJson without raw transport, duplicate DTOs, filesystem access, or mutation
• present Agent reachability/compatibility states, server and policy metadata, enforcement, ordered rules, all matches/constraints, and canonical JSON with clipboard copy
• keep inspection independent of UseAgentBroker, cancellable, stale-safe, localized, searchable, accessible, and NativeAOT-safe
• centralize broker client construction so existing brokered package operations retain their transport/elevation behavior
• validate required/defaulted policy data against shared schema constraints and classify malformed nested, unknown-property, numeric-enum, and noncanonical-enum payloads as InvalidResponse

Coordinated Phase 1 work

• shared contract/client: feat: add active package policy inspection contract now-libraries#93
• Agent endpoint: feat(agent): expose active package policy devolutions-gateway#1937
• inspector UI: Add read-only package broker policy inspector #5292

Exact local integration evidence

Validated against now-libraries PR #93 head 032a8f2376bf4ef32e94f04fe672651dd22227a3 using the rebuilt unpublished 0.4.0 package set documented by its authoritative MANIFEST.md and SHA256SUMS.txt. All six hashes were independently recomputed. Restore used command-line RestoreAdditionalProjectSources and a new empty package cache; the three restored nupkg hashes and .nupkg.metadata source entries confirm that Model, API, and Client came from this exact artifact set. No local feed path, NuGet configuration, or cache is committed.

Focused compatibility validation against this exact set:

• policy inspector: 82 passed on each PackageEngine target (net10.0 and net10.0-windows10.0.26100.0), 164 executions total
• existing broker request/package/source operation regressions: 81 passed on each PackageEngine target, 162 executions total
• inspector view-model/settings-search tests: 18 passed

The existing unchanged-code baseline remains 1,380 Windows solution tests passed and a successful win-x64 NativeAOT publish with no inspector-specific trim/AOT diagnostics. The full solution and NativeAOT publish were not rerun for this package rebuild because the C# binaries/contracts, dependency graph, and UniGetUI code are unchanged; the exact-artifact focused checks above passed.

Dependency/publication gate

This PR intentionally remains draft. Devolutions.Now.Policy.Model, .Api, and .Client 0.4.0 are not yet published to the configured public NuGet feed. Final readiness is blocked on publishing the exact packages produced from now-libraries#93 head 032a8f2376bf4ef32e94f04fe672651dd22227a3, updating the committed package references if the published identity changes, and rerunning restore/tests/NativeAOT from the public feed.

The non-Windows runtime matrix remains a runner gap; defensive platform guards and Windows-only settings-search filtering are covered by unit tests. Do not mark ready or merge until the coordinated dependency gate is cleared.