fix(detection): tri-state certutil-backed CA properties so query failure is not a finding

[jakehildreth]

fix(detection): tri-state certutil-backed CA properties so query failure is not a finding

Closes #92, together with jakehildreth/PSCertutil#2.

Root cause (two layers)

1. PSCertutil (the actual trigger): parseAuditFilter ran [int]$AuditFilter = $null on certutil failure, coercing $null to 0, then always emitted @{ AuditFilter = 0 }. A failed -getreg CA\AuditFilter returned a real 0, so Locksmith2 computed AuditingIncomplete = (0 -ne 127) = $true → "auditing not enabled" on a query failure. Fixed in fix(parse): emit nothing on certutil failure instead of fabricated 0 PSCertutil#2 (parser now emits nothing on parse failure).

2. Locksmith2 (the design gap, this PR): the four certutil-backed detection properties had no "unknown" state. AuditingIncomplete was a non-nullable [bool], so a failed/absent query was indistinguishable from "queried, clean." Defense-in-depth even with a fixed parser.

What changed

• Classes/LS2AdcsObject.ps1: AuditingIncomplete → [Nullable[bool]]; $null = unknown/never queried.
• All four Set-CA* cmdlets (AuditFilter, EditFlags, InterfaceFlags, DisableExtensionList): set their detection properties to $null on both throw and empty-result paths, so failure is never clean and a stale rescan value cannot survive.
• Fixed Set-CADisableExtensionList catch block: it set properties on $_ (the ErrorRecord inside catch), so the failure path had never worked.
• Tests: failure-path contexts (throw + null-result) in all four Set-CA* suites, PSCertutil stub for Set-CADisableExtensionList, Find-level regression proving a CA with AuditingIncomplete = $null emits no Auditing issue.

Verification

• 56/56 targeted tests pass in pwsh 7.6.5.
• Full suite: 238 pre-existing macOS platform failures, identical on unmodified main (no Windows Principal/System.DirectoryServices APIs); zero new failures.
• PS 5.1 leg pending — must run on Windows (powershell.exe) before merge.

Not in this change

• PSCertutil fix lands in its own repo/PR (fix(parse): emit nothing on certutil failure instead of fabricated 0 PSCertutil#2).
• "Unknown" state surfaces only at -Verbose; a visible warning/dashboard state is possible follow-up, deliberately out of scope.