Apply reviewed SACL plans to explicitly selected local targets (#422)

* Add reviewed configuration for selected native SACL targets

* Link selected SACL changelog to PR 422

* Identify native full-descriptor read failures without partial fallback

* Fix diagnostic variable scope in native C# helper

* Read explicit descriptor sections and retain observation scope

.gitattributes

@@ -15,5 +15,11 @@
 # Full upstream rule artifacts retain their exact pinned bytes on every platform.
 /config/provider_rule_sources/*.yml -text whitespace=-blank-at-eol
 
+# Selected SACL review plans pin these exact source bytes.
+/config/audit_sacl_targets.json text eol=lf
+/scripts/TargetedSaclPlanning.ps1 text eol=lf
+/scripts/SelectedSaclConfiguration.ps1 text eol=lf
+/scripts/SelectedSaclNative.cs text eol=lf
+/modules/AuditCatalog.psm1 text eol=lf
 # Fixed public pending-request fixture is pinned by its exact byte hash.
 /tests/fixtures/adcs-pending-probe.csr text eol=lf