test(inbox): allow the Defender platform's two modules to be absent on the host

[fadwen]

Summary

Tests/Unit/Private/Get-IslInboxModule.Tests.ps1 checks that every module the inbox table lists is under the host's system module paths, with an allowance for the Pro and Enterprise features a Home edition does not ship. On 15 October the Windows on ARM job failed that check on the docs/validation-kit branch, twice, with ConfigDefender and ConfigDefenderPerformance missing, while the same runner image (windows-11-vs2026-arm64 20261013.183.4) had passed it on fix/inex-evidence ten minutes earlier.

Those two modules are placed under System32\WindowsPowerShell\v1.0\Modules by the Microsoft Defender platform update, not by the Windows image, so a host whose Defender platform is still at the image's baseline does not have them yet. Which hosted runner has taken the update is not something the test can control.

Changes

• The test keeps a second allowance list, PlatformUpdateModules, for the two Defender platform modules, and leaves them out of the "missing from the host" check the way it leaves out the edition-only modules. The table itself is unchanged: a device that has updated once has both, and the rule that reads the table is about what a script may import on a managed device.

Verification

• Get-IslInboxModule.Tests.ps1: 4 passed on PowerShell 7.6.6 on this ARM64 host, where both modules are present and the allowance is not exercised.
• The failing runs: https://github.com/fadwen/IntuneScriptLab/actions/runs/38776321733 (first run and rerun, ARM job only). The passing run on the same image: https://github.com/fadwen/IntuneScriptLab/actions/runs/38775820330.

Notes

• Not stacked. Merge before chore(validation): restart the agent the way that works, and bring the kit's scripts and docs up to date #44 so its Windows on ARM check can pass; fix(deployed): cite the experiments that back the assignment and file-rule evidence #43 is unaffected.

[fadwen]

Notes on the lines whose reason the diff does not show.

[fadwen]

A separate list rather than two more names in EditionOnly: the edition list is about what a Home SKU never ships, and this pair is about timing on any SKU. Keeping them apart keeps the comment on each honest, and the table stays as it is because a managed device that has taken one platform update has both modules, which is what the IslModuleDependency rule needs to know.