Enhance pinget upgrade output

[Gabriel Dufresne (GabrielDuf)]

pinget upgrade was diverging from winget upgrade in two directions — silently dropping real upgrades (.NET SDK 10/9, Python 3.14, App Installer, Microsoft Teams correlation) and inventing phantom ones (mis-routed Git, side-by-side WindowsAppRuntime, Edge MSIX stub, Notepad++ Store stub). Root cause: pinget was correlating installed packages by display name only, while winget uses the v2 index's identity tables (pfns2, productcodes2, upgradecodes2, norm_names2, norm_publishers2) and the catalog's versionData.mszyml aMiV/aMaV ranges.

This branch ports the missing pieces to both implementations (Rust + C#, kept in lockstep per AGENTS.md), adds a structured parity harness, and verifies byte-equivalent output on the development machine.

Behavior changes

Aligned on both implementations (rust/crates/pinget-core/src/lib.rs and dotnet/src/Devolutions.Pinget.Core/):

• Identity correlation via the v2 index. pfns2 / upgradecodes2 / productcodes2 lookups, in that order — UpgradeCode is preferred over ProductCode because it's the MSI family identity (stable across versions) while ProductCode churns per release. Fixes Node.js being attributed to OpenJS.NodeJS.LTS instead of OpenJS.NodeJS.22.
• ARP DisplayVersion → catalog Version remap. versionData.mszyml's aMiV/aMaV per-version ranges translate MSI build numbers (10.1.826.23019) to the catalog Version they represent (10.0.108), so the upgrade comparison runs on a single scale.
• Latest ARP-anchored Version as "available". Catalog packages that publish both internal MSI builds and user-facing versions (e.g. Microsoft.WindowsAppRuntime.1.8 carries an 8000.836.2153.0 row plus 1.8.6) compare against the user-facing version, not the internal one.
• MSIX entries require PFN identity. Name-based correlation no longer applies to MSIX rows — fixes the Microsoft Edge Stable MSIX stub being mis-correlated to the catalog's M