Fix Windows task and certificate collector reliability

tests/powershell/Test-Collectors.ps1

@@ -82,3 +82,63 @@ $script:SamsaraIsElevated=$false
 $section=Invoke-SamsaraSection 'services' {param($r) Get-SamsaraServices $r}
 Assert-True ($section.status -eq 'partial' -and $section.permission_limitations.Count -gt 0) 'Non-elevated scope not marked partial'
 Write-Output 'PowerShell AST and synthetic collector tests passed. No real Windows inventory was collected.'
+# Reliability cases: mocks never access real tasks, certificates or private keys.
+$script:SamsaraIsElevated=$true
+$script:SamsaraDiagnostic=$true
+function New-TestTask {
+    param([bool]$Enabled=$true)
+    [pscustomobject]@{TaskName='Example';TaskPath='\';State='Ready';Settings=[pscustomobject]@{Enabled=$Enabled};Principal=[pscustomobject]@{UserId='SYSTEM'};Actions=@([pscustomobject]@{Execute='"C:\Tools\bad.exe"';Arguments='SECRET'});Triggers=@()}
+}
+function Get-ScheduledTask { [CmdletBinding()]param() New-TestTask $true; New-TestTask $false }
+$r=Invoke-SamsaraSection tasks {param($r) Get-SamsaraTasks $r}
+Assert-True ($r.status -eq 'complete' -and $r.data.Count -eq 2 -and -not $r.data[1].enabled) 'Normal/disabled tasks lost'
+Assert-True ($r.data[0].executables -eq '[executable name omitted]') 'Malformed executable not sanitized'
+function Get-ScheduledTask { [CmdletBinding()]param() }
+$r=Invoke-SamsaraSection tasks {param($r) Get-SamsaraTasks $r}
+Assert-True ($r.status -eq 'complete' -and $r.data.Count -eq 0) 'Successful empty task query failed'
+function Get-ScheduledTask { [CmdletBinding()]param() Write-Error 'SECRET' -Category PermissionDenied }
+$r=Invoke-SamsaraSection tasks {param($r) Get-SamsaraTasks $r}
+Assert-True ($r.status -eq 'failed' -and $r.data.Count -eq 0) 'Failed task query treated as empty success'
+function Get-ScheduledTask {
+    [CmdletBinding()]param()
+    New-TestTask
+    $bad=New-TestTask
+    $bad | Add-Member ScriptProperty TaskName { throw [UnauthorizedAccessException]::new('SECRET') } -Force
+    # Throw from ToString to reliably exercise projection failures on both runtimes.
+    $value=New-Object PSObject
+    $value | Add-Member ScriptMethod ToString { throw [UnauthorizedAccessException]::new('SECRET') } -Force
+    $bad.TaskPath=$value
+    $bad
+}
+$r=Invoke-SamsaraSection tasks {param($r) Get-SamsaraTasks $r}
+Assert-True ($r.status -eq 'partial' -and $r.data.Count -eq 1 -and $r.errors.Count -gt 0) 'Individual task failure discarded healthy records'
+Assert-True (($r | ConvertTo-Json -Depth 12) -notmatch 'SECRET') 'Diagnostic leaked secret'
+$script:StoreMode='normal'
+function Get-ChildItem {
+    [CmdletBinding()]param($LiteralPath)
+    if ($LiteralPath -eq 'Cert:\LocalMachine') {
+        foreach ($n in @('My','Root','Empty')) { [pscustomobject]@{PSChildName=$n;PSPath=('Microsoft.PowerShell.Security\Certificate::'+$n)} }
+    } elseif ($LiteralPath -eq 'Cert:\LocalMachine\Empty') { return }
+    elseif ($LiteralPath -in @('Cert:\LocalMachine\My','Cert:\LocalMachine\Root')) {
+        if ($script:StoreMode -eq 'denied' -or ($script:StoreMode -eq 'partial' -and $LiteralPath -like '*Root')) { throw [UnauthorizedAccessException]::new('SECRET') }
+        [pscustomobject]@{Subject='CN=Example';Issuer='CN=CA';Thumbprint='00';NotAfter=[datetime]::UtcNow;PrivateKey='SECRET'}
+    } else { throw 'Incorrect certificate provider path' }
+}
+$r=Invoke-SamsaraSection certificates {param($r) Get-SamsaraCertificates $r}
+Assert-True ($r.status -eq 'complete' -and $r.data.Count -eq 2 -and @($r.data.store | Select-Object -Unique).Count -eq 2) 'Multiple stores/empty store failed'
+$script:StoreMode='partial'
+$r=Invoke-SamsaraSection certificates {param($r) Get-SamsaraCertificates $r}
+Assert-True ($r.status -eq 'partial' -and $r.data.Count -eq 1 -and $r.errors[0].code -eq 'access_denied') 'Partial store failure lost records'
+Assert-True (($r | ConvertTo-Json -Depth 12) -notmatch 'SECRET') 'Certificate diagnostics leaked secret'
+function Get-ChildItem { [CmdletBinding()]param($LiteralPath) if ($LiteralPath -eq 'Cert:\LocalMachine') { [pscustomobject]@{PSChildName='My'} } else { throw [UnauthorizedAccessException]::new('SECRET') } }
+$r=Invoke-SamsaraSection certificates {param($r) Get-SamsaraCertificates $r}
+Assert-True ($r.status -eq 'failed' -and $r.data.Count -eq 0) 'Inaccessible stores treated as empty success'
+function Get-ChildItem { [CmdletBinding()]param($LiteralPath) }
+$r=Invoke-SamsaraSection certificates {param($r) Get-SamsaraCertificates $r}
+Assert-True ($r.status -eq 'complete' -and $r.data.Count -eq 0) 'Empty store list failed'
+function Get-ScheduledTask { [CmdletBinding()]param() New-TestTask }
+function ConvertTo-Json { [CmdletBinding()]param($InputObject,$Depth,[switch]$Compress) throw [InvalidOperationException]::new('SECRET serialization') }
+$r=Invoke-SamsaraSection tasks {param($r) Get-SamsaraTasks $r}
+Assert-True ($r.status -ne 'complete' -and $r.data.Count -eq 0 -and $r.errors.Count -eq 1) 'Serialization failure accepted as evidence'
+Remove-Item Function:\ConvertTo-Json
+Write-Output 'Reliability collector tests passed.'