fix(windows): respect managed power button policy

[DevSecNinja]

Summary

• detect the documented ACSettingIndex and DCSettingIndex policy values before invoking powercfg
• return ManagedByPolicy without writes when both values enforce Take no action
• fail with actionable policy ownership details for partial or conflicting policy configuration
• preserve unmanaged Surface behavior, non-Surface skips, WhatIf, PowerShell 5.1 native-error handling, and strict nonzero exit propagation
• add focused Pester coverage for registry detection, desired and conflicting policy, idempotency, unmanaged writes, WhatIf, and native errors

Root cause

PR #711 added a current-user powercfg write for Surface Laptop power-button behavior. Machines provisioned by windows-iso-maker already carry machine-wide Power ADMX policy values for the same setting, so Windows correctly rejects the lower-precedence power-plan write with a Group Policy override error.

Validation

• targeted Pester: 14 passed
• full PowerShell Pester suite: 798 passed, 14 skipped
• PSScriptAnalyzer: no Error/Warning findings
• chezmoi apply --dry-run --source=.: passed
• Lefthook pre-commit (shellcheck, shfmt, executable-bit checks): passed
• Bash/Bats broader suite: 855 passed and 1 unrelated existing git-config-credentials failure on this environment