Improve package listing parity

[Marc-André Moreau (mamoreau-devolutions)]

Summary

This PR improves Pinget parity with the system winget.exe across package listing, installed-package identity, update/install feedback, and custom WinGet REST sources. It keeps the Rust and C# implementations aligned while preserving separate code paths for each implementation.

Major changes

Package listing parity

• Added scripts\compare-list.ps1 to compare system winget list output against both Pinget implementations.
• Fixed ARP/MSIX listing discrepancies so Pinget no longer reports extra split/resource MSIX packages that WinGet suppresses.
• Added AppModel display metadata fallback for base packages whose top-level display name is missing.
• Fixed duplicate available-version reporting in plain list; only the newest installed row for a duplicated catalog ID now shows the available upgrade, matching WinGet.
• Improved ARP/MSIX version mapping using WinGet versionData, including serviced framework/version-range cases.
• Preserved system winget source export ordering for source priority parity.
• Added exact installed-db identity correlation before looser source-index/name correlation.
• Fixed Desktop App Installer installed-db path handling.
• Enriched preindexed installed-db hits through v2 metadata/versionData.

WinGet ARP identity metadata

• Rust and C# now read WinGet ARP metadata such as WinGetPackageIdentifier and WinGetSourceIdentifier.
• Installed packages from custom REST sources, including tessl.tessl, keep the correct catalog ID even when Pinget runs with a private app root that does not already know the source.
• Source identifiers are mapped back to configured friendly source names where possible, e.g. api.winget.pro -> winget.pro.

Private system WinGet source mirror

• Added source modes in both implementations:
  • Auto
  • Private
  • SystemWingetMirror
• Default current-user CLI behavior now uses Auto.
• When PINGET_APPROOT is not explicitly set, Pinget mirrors system WinGet source definitions into Pinget-owned private state instead of requiring direct writes to WinGet LocalState.
• Mirrored source definitions are stored in Pinget private state as system-sources.json.
• Pinget-owned cache/index/installed tracking remains under Pinget's private app root.
• Explicit PINGET_APPROOT and explicit library AppRoot remain private by default.
• Desktop App Installer packaged LocalState remains supported as the direct system-source layout for compatibility.
• Mirror mode uses source-identifier-keyed state paths to avoid collisions and align with WinGet source identity semantics.
• source update in mirror mode refreshes Pinget private caches/index metadata for mirrored sources.
• source add, source remove, and source reset in system-source modes continue to route through winget source ... rather than directly editing WinGet files.

show metadata for mirrored/custom sources

• Fixed pinget show --id tessl.tessl --exact --source winget --output json when callers pass the WinGet manager alias (winget) instead of the custom REST source name (winget.pro).
• show and show --versions now retry across the mirrored system WinGet source set only for clean misses from --source winget.
• Install/update source filtering remains stricter and does not use this metadata-only fallback.
• Source resolution now accepts source identifiers such as api.winget.pro in addition to friendly source names such as winget.pro.

Install/update progress

• Added Rust install/update progress callbacks and CLI phase messages so long-running package operations show which phase they are in.
• This helps distinguish Pinget resolution/download time from the external installer/MSI execution phase.

Important behavior changes

• PINGET_APPROOT should now be treated as Pinget's writable state root, not as the mechanism required for WinGet source parity.
• Normal no-PINGET_APPROOT Pinget calls can see system WinGet custom sources through the private mirror while avoiding writes to WinGet LocalState.
• Explicit private app roots remain isolated by default, which is important for tests, tools, and callers that intentionally want independent Pinget state.
• The metadata-only show --source winget fallback may return a package from a custom WinGet source when the default winget source has no match and system-source mirroring is active. This is intentional for UniGetUI-style manager-alias metadata lookups.

Validation

• Rust formatting, tests, clippy, and release build were run:
  • cargo +nightly fmt --manifest-path rust\Cargo.toml --all
  • cargo test -p pinget-core --manifest-path rust\Cargo.toml
  • cargo test -p pinget-cli --manifest-path rust\Cargo.toml
  • cargo clippy -q --manifest-path rust\Cargo.toml --workspace --tests -- -D warnings
  • cargo build -p pinget-cli --manifest-path rust\Cargo.toml --release
• C# tests/build were run:
  • dotnet test dotnet\src\Devolutions.Pinget.Core.Tests\Devolutions.Pinget.Core.Tests.csproj -c Release
  • dotnet build dotnet\Devolutions.Pinget.slnx -c Release
• Live validation confirmed Rust and C# list tessl.tessl correctly with default no-PINGET_APPROOT, explicit private app root, and system WinGet app root modes.
• Live validation confirmed Rust and C# return full tessl.tessl metadata for show --id tessl.tessl --exact --source winget --output json.

Known limitation

The remaining observed OpenSSL discrepancy is a WinGet query-context difference: unfiltered winget list leaves multiple OpenSSL rows raw, while filtered WinGet queries and both Pinget implementations correlate them to ShiningLight.OpenSSL.Dev. This PR does not fake different behavior for that case.