Read settings from the 64-bit registry only, and keep credential headers where users cannot read them

[rodchristiansen]

64-bit view only

• The CLI and the GUI read HKLM\SOFTWARE\BootstrapMate\Settings and the policy key from the 64-bit view only. A stale WOW6432Node copy of the settings key used to outrank what the GUI and the MSI write.
• The MSI removes that copy through a 32-bit component. The CLI also removes it once, logging only the value names.
• SOFTWARE\Policies is shared between the views. Its "32-bit path" is the live policy key, so it is never removed, and a test guards that.

Credential headers

• AuthorizationHeader and ReportingHeader live in HKLM\SOFTWARE\BootstrapMate\Secrets. The key's protected ACL admits SYSTEM and Administrators only, and the MSI sets the same ACL.
• An elevated run moves a header it finds in the policy key (under any alias) or the settings key into the store, then blanks the readable copy. The policy value is emptied rather than deleted, so the setting still shows as managed.
• The GUI saves headers to the store and no longer passes one on the CLI command line. Command lines are redacted (--headers <redacted>) in the log and session.json.

Tested on a test PC (signed MSI)

• After install: the stale 32-bit settings key is removed, and policy and 64-bit settings are untouched.
• An elevated run moved a policy header and a settings header into the store and blanked both copies. Its log shows --headers <redacted>.
• A test token appeared in no file under ProgramData.
• As a standard user: the store key is denied, the policy and settings values are empty, and no file holds the token.
• dotnet test: 122 pass.