Guard AD CS audit configuration and collect native request evidence (#421)

* Add guarded native CA auditing and disposable request evidence

* Link AD CS changelog to PR 421

* Retain primary native CA failure before cleanup diagnostics

* Normalize native CA certificate hashes and record pending feature removal

* Emit bounded disposable CA request matching diagnostics

* Match observed version 1 CA request events with exact pending disposition

.gitattributes

@@ -14,3 +14,6 @@
 /modules/AuditProfiles.psm1 text eol=lf
 # Full upstream rule artifacts retain their exact pinned bytes on every platform.
 /config/provider_rule_sources/*.yml -text whitespace=-blank-at-eol
+
+# Fixed public pending-request fixture is pinned by its exact byte hash.
+/tests/fixtures/adcs-pending-probe.csr text eol=lf