Implement AutoScheduler engine, MDE alert detection, job timeout, MDE onboarding, and domain credentials

[Copilot]

The E2E analysis identified six gaps preventing ShieldChecker from completing its core mission: scheduled jobs never fire, MDE never onboards on worker VMs, alert detection is skipped entirely (jobs go straight to Completed), domain credentials are always null, and stuck jobs never time out.

AutoScheduler Execution Engine

• AutoSchedulerService — 60s polling BackgroundService that evaluates due AutoSchedule entries, applies FilterOperatingSystem/FilterExecution/FilterRandomCount, creates Queued jobs, and advances NextExecution
• Uses SchedulerMutex with stale-lock reclamation to prevent concurrent evaluation across replicas

MDE Alert Detection

• MdeAlertDetectionService — queries Graph Security API (/security/alerts_v2) for jobs in WaitingForDetection, correlates by DefenderMachineId + time window + expected alert title
• 15-min detection delay, 4-hour search window, populates DetectedAlerts JSON and sets Result
• Respects Settings.JobReview → routes to ReviewPending or Completed

Worker Status Flow Fix

• Worker now reports Status = 2 (WaitingForDetection) instead of Completed
• JobUpdaterController defaults to WaitingForDetection; final completion is handled by the MDE detection service

MDE Onboarding on Worker VMs

• HostEngine.ExecuteJobInVm() runs the MDE onboarding script between VM boot and prerequisite execution
• VmSettings and HostServiceApi.SettingsController now expose MdeWindowsOnboardingScript/MdeLinuxOnboardingScript

Domain Credentials

• JobController.GetJob() populates Username/Domain based on ExecutorUserType:
  • domain_admin → Administrator@{DomainFQDN}
  • domain_user → testuser@{DomainFQDN}
  • local_admin/System → handled by HostService config or not needed

Job Timeout Enforcement

• JobTimeoutService — 2-min polling service marks jobs in Queued/WaitingForMDE/WaitingForDetection as Error when they exceed Settings.JobTimeout

Tests

16 new unit tests covering AutoSchedulerService (schedule evaluation, OS/execution/random filters, next-execution calculation, disabled schedule/test handling) and JobTimeoutService (timeout enforcement, boundary conditions, status filtering). All 39 tests pass.