Prepare ms-private 0.0.1 release candidate

Services.ps1

@@ -0,0 +1,11 @@
+#Requires -Version 5.1
+[CmdletBinding(SupportsShouldProcess)]param([ValidateSet('Audit','Plan','Apply','Restore')][string]$Mode='Plan',[ValidateSet('Standard','Strict')][string]$Profile='Strict',[string]$Journal,[switch]$Json)
+Set-StrictMode -Version Latest;$ErrorActionPreference='Stop';Import-Module (Join-Path $PSScriptRoot 'src/Wind.Core.psm1');Import-Module (Join-Path $PSScriptRoot 'src/MsPrivate.Services.psm1') -Force
+$backend=New-MsPrivateServiceBackend
+if($Mode-in@('Audit','Plan')){$plan=@(Get-MsPrivateServicePlan -Profile $Profile -Backend $backend);if($Json){[pscustomobject]@{Schema=1;Profile=$Profile;Claim='Local service state only; GDID suppression requires network capture validation.';Services=$plan}|ConvertTo-Json -Depth 8}else{$plan|Select-Object Id,Name,Status,Impact|Format-Table -Wrap};return}
+Assert-WindMutationAllowed
+$root=Join-Path ([Environment]::GetFolderPath('LocalApplicationData')) 'MsPrivate\services';[IO.Directory]::CreateDirectory($root)|Out-Null
+if($Mode-eq'Apply'){$plan=@(Get-MsPrivateServicePlan -Profile $Profile -Backend $backend);$Journal=Join-Path $root ((Get-Date -Format 'yyyyMMdd-HHmmss')+'-'+[guid]::NewGuid().ToString('N')+'.json')}elseif([string]::IsNullOrWhiteSpace($Journal)){throw 'Restore requires -Journal.'}
+if(-not$PSCmdlet.ShouldProcess('Selected Windows privacy services',$Mode)){return}
+if($Mode-eq'Apply'){$journal=$null;$save={param($x)Save-MsPrivateServiceJournal -Journal $x -Path $Journal}.GetNewClosure();$journal=Invoke-MsPrivateServiceApply -Plan $plan -Backend $backend -Save $save}else{$journal=Get-Content -LiteralPath $Journal -Raw|ConvertFrom-Json;$save={param($x)Save-MsPrivateServiceJournal -Journal $x -Path $Journal}.GetNewClosure();$journal=Restore-MsPrivateServices -Journal $journal -Backend $backend -Save $save}
+$journal|Select-Object Kind,Status,CreatedUtc|Format-List;Write-Output "Service recovery journal: $Journal"