Collect local WMI namespace audit evidence with a fixed read probe (#428)

* Collect bounded local WMI namespace access evidence

* Reference PR428 and preserve UTC worker query timestamps

* Observe equivalent runtime self tokens without reverting caller context

* Test native token equivalence against restricted caller changes

* Diagnose native token differences and package WMI probe guidance

* Limit WMI connections to the explicitly scoped security privilege

* Document verified native WMI events and privilege preservation

* Require an already-running WMI service before namespace reads

scripts/WmiNamespaceAuditing.ps1

@@ -129,7 +129,10 @@ function Get-WelaWmiMissingAces {
 function New-WelaWmiConnection {
     param([string]$Namespace)
     $options = New-Object System.Management.ConnectionOptions
-    $options.EnablePrivileges = $true
+    # The caller already enables exactly SeSecurityPrivilege and restores it.
+    # Automatic WMI privilege enabling can leave unrelated privileges enabled
+    # on a thread impersonation token (observed SeBackupPrivilege on hosted CI).
+    $options.EnablePrivileges = $false
     $options.Impersonation = [System.Management.ImpersonationLevel]::Impersonate
     $scope = New-Object System.Management.ManagementScope -ArgumentList "\\.\$Namespace", $options
     $scope.Connect()