fix: support target-user policies and add screenshots

[xsyetopz]

Possibly solves #31 with partial solve for #14 . Needs more look by primary maintainer.

[greptile-apps]

Greptile Summary

This PR adds -UserSid support so an elevated administrator can target another loaded Windows user's policy hive (HKEY_USERS\<SID>\...) without switching sessions, removes two deprecated Brave policies (PrivacySandboxPromptEnabled, PromotionalTabsEnabled) from the active manifest, and adds screenshot assets plus documentation updates.

• Target-user policy support: adds Assert-UserSid (regex + numeric range validation), extends Get-RegistryPolicyPath/Get-RegistryBasePath/Get-PolicyTarget to accept -UserSid and enforce elevation + hive-loaded checks on apply, and hardens Assert-BackupRegistryPath so HKEY_USERS restores require an explicit matching -UserSid rather than a -PolicyPath override.
• Deprecated-policy hygiene: moves PrivacySandboxPromptEnabled and PromotionalTabsEnabled to a new deprecatedPolicies array in config/policies.json; Test-PolicyManifest.ps1 now reads that field and asserts those names are absent from the active policies map, addressing the previous review suggestion about a hardcoded static list.
• Test coverage: Test-Behavior.ps1 gains path construction, dry-run output, invalid-SID rejection, non-Windows/machine-scope rejection, unelevated-apply rejection, restore-without-UserSid rejection, unsafe-path rejection, and -PolicyPath-cannot-authorize-HKEY_USERS-restore assertions.

Confidence Score: 5/5

Safe to merge. The -UserSid feature is gated by thorough upfront validation, enforces elevation and hive-loaded checks at apply time, and blocks -PolicyPath from authorizing HKEY_USERS restores — all backed by matching behavioral tests.

Every changed path — apply, dry-run, and restore — follows the correct guard order: SID format validation → platform/scope/mode guards → elevation check → hive-loaded check → path construction. The deprecated-policy removal is consistent across the policies map, feature arrays, and the new manifest validation check. No registry write can reach an unintended path.

No files require special attention. All five substantively changed files (PlatformPolicy.ps1, Backup.ps1, Invoke-BraveDebloat.ps1, config/policies.json, Test-Behavior.ps1) are internally consistent with each other.

Important Files Changed

Filename	Overview
src/PlatformPolicy.ps1	Adds Assert-UserSid (regex + numeric-range validation), extends Get-RegistryPolicyPath/Get-RegistryBasePath/Get-PolicyTarget to accept -UserSid and enforce elevation + hive-loaded checks on apply. Logic is correct and consistent with the main entrypoint guards.
src/Backup.ps1	Assert-BackupRegistryPath now classifies HKEY_USERS paths, validates the extracted SID, and requires a matching AllowedUserPolicyPath; -PolicyPath cannot authorize an HKEY_USERS restore. Elevation and hive-loaded checks are applied consistently at DoApply time.
Invoke-BraveDebloat.ps1	Adds -UserSid parameter with early validation block (platform, scope, doctor, profile-root, list-mode guards), computes AllowedUserPolicyPath only for restore path, and forwards -Apply to Get-PolicyTarget. Guards are comprehensive and ordered correctly.
config/policies.json	Bumps policyTemplateVersion to 151.1.94.91, removes PrivacySandboxPromptEnabled and PromotionalTabsEnabled from the active policy map and feature arrays, and adds a deprecatedPolicies array to record them for manifest validation.
scripts/Test-PolicyManifest.ps1	Now reads deprecatedPolicies from policies.json rather than a hardcoded static array, and asserts each deprecated name is absent from the active policies map. Addresses the previous review comment about manual maintenance burden.
scripts/Test-Behavior.ps1	Adds comprehensive UserSid test cases: path output, invalid-SID rejection, non-Windows/LocalMachine rejection, unelevated-apply rejection (wrapped in a function to avoid session-scope pollution), and multiple restore-authorization scenarios.

_{Reviews (2): Last reviewed commit: "fix: address review findings" | Re-trigger Greptile}