Refactor PowerShell into a thin EventViewerX v4 surface

[PrzemyslawKlys]

Summary

• makes EventViewerX the reusable owner for query planning, typed filters, named-event projection, subscriptions, provider workflows, checkpoints, and archive behavior while keeping compiled PowerShell cmdlets thin
• consolidates the public module into 26 canonical EVX cmdlets with deliberate parameter sets and three migration aliases: Find-WinEvent, Get-EVXFilter, and Write-EVXEntry
• adds typed collector-initiated WEC definitions with create/update readback, bounded cancellation, verified rollback, and explicit unknown-state reporting
• standardizes channel, provider, offline EVTX, XPath/XML, named-event, time-period, checkpoint, export, write, watcher, log, source, and provider-package workflows
• replaces the report-shaped EventObjectSlim projection with a stable NamedEventRecord envelope that preserves the source event for downstream automation
• refreshes examples, generated Markdown help, MAML, manifest exports, and the migration guide

Breaking changes

• Get-EVXFilter is now a migration alias for the canonical New-EVXFilter
• the duplicate ConvertTo-EVXProviderDefinition, Get-EVXEventStatistics, Get-EVXPowerShellScriptExecution, and Get-EVXProviderPackage commands are removed in favor of parameter sets on the owning commands
• Write-EVXEntry remains as a migration alias for the classic Write-EVXEvent parameter set, including legacy -Source and -Provider binding
• named-event results now use EventViewerX.NamedEventRecord

Validation

• solution build across net472, net8.0-windows, and net10.0-windows: 0 warnings, 0 errors
• EventViewerX tests: 706/706 on .NET 8 and 706/706 on .NET 10
• exact unpacked module: 184 passed on PowerShell 7 and 181 passed on Windows PowerShell 5.1, with 3 intentional skips on each runtime
• PowerForge module/NuGet/package build completed with 26 Markdown and 26 MAML command pages
• packaged module read a real offline EVTX, queried AD1 remotely, and completed a disposable WEC create/read/delete transaction while restoring Wecsvc to its original state

Scope

This PR does not add reporting, SQL storage, TestimoX integration, email/Teams dependencies, or publish a new package version. The returned objects and export paths remain pipeline-friendly for those future workflows.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.