Measure bounded native event delivery and verify exact EVTX samples (#430)

* Add bounded local delivery measurement and exact EVTX samples

* Link delivery measurement changelog to PR 430

* Reject evidence aliases before Windows path normalization

* Use PowerShell 5.1-compatible record IDs and bound fixture cleanup

* Revalidate the native EVTX artifact before recording final evidence

* Require exact observed local computer identities for sampled events

* Clarify provider scope within shared built-in event channels

* Preserve mixed XML payload ordering in EVTX sample verification

* Bound ordered event XML comparisons for nested UserData

* Dispose observer wait handle when bookmark creation fails

.gitattributes

@@ -39,6 +39,10 @@ modules/WecSubscriptionXml.cs text eol=lf
 scripts/AppLockerProbe.ps1 text eol=lf
 tests/AppLockerProbe*.ps1 text eol=lf
 
+# Local delivery catalog and native observer retain reproducible source bytes.
+config/event_measurement.json text eol=lf
+scripts/EventMeasurement* text eol=lf
+tests/EventMeasurement* text eol=lf
 tests/SelectedSaclFixtureProtection.cs text eol=lf
 # Fixed local WMI probe source/worker fingerprints.
 /scripts/WmiProbe*.ps1 text eol=lf