fix: сравнение SSLCertificateSHA1Hash — байты реестра vs hex thumbprint

Реестр отдаёт byte[]; TermService принимал cert, но проверка Persisted ложно падала.
Добавлены ConvertTo-RdpRepairThumbprintHex и самотесты на форматы DAK-PC.

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/lib/RdpRepair.Common.ps1

@@ -56,12 +56,46 @@ function Get-RdpRepairComputerDnsNames {
     return $names | Select-Object -Unique
 }
 
+function ConvertTo-RdpRepairThumbprintHex {
+    param([object]$HashValue)
+    if ($null -eq $HashValue) { return $null }
+
+    if ($HashValue -is [byte[]]) {
+        if ($HashValue.Length -eq 0) { return $null }
+        return -join ($HashValue | ForEach-Object { '{0:X2}' -f $_ })
+    }
+
+    if ($HashValue -is [System.Array] -and $HashValue.Count -gt 0) {
+        $allNumeric = $true
+        foreach ($b in $HashValue) {
+            if ($b -isnot [byte] -and $b -isnot [int] -and $b -isnot [short]) {
+                $allNumeric = $false
+                break
+            }
+        }
+        if ($allNumeric -and ($HashValue.Count -eq 20 -or $HashValue.Count -eq 16)) {
+            return -join ($HashValue | ForEach-Object { '{0:X2}' -f [byte]$_ })
+        }
+    }
+
+    $text = [string]$HashValue
+    if ([string]::IsNullOrWhiteSpace($text)) { return $null }
+    $text = $text.Trim()
+
+    if ($text -match '^\d+( \d+)+$') {
+        $bytes = $text -split '\s+' | ForEach-Object { [byte]$_ }
+        return -join ($bytes | ForEach-Object { '{0:X2}' -f $_ })
+    }
+
+    $hex = ($text -replace '\s', '').ToUpper()
+    if ($hex -match '^[0-9A-F]+$') { return $hex }
+    return $null
+}
+
 function Get-RdpRepairSslCertificateHash {
     $p = Get-ItemProperty -Path $script:RdpRepairRdpTcpKey -Name SSLCertificateSHA1Hash -ErrorAction SilentlyContinue
-    if ($null -eq $p -or [string]::IsNullOrWhiteSpace($p.SSLCertificateSHA1Hash)) {
-        return $null
-    }
-    return $p.SSLCertificateSHA1Hash
+    if ($null -eq $p -or -not $p.PSObject.Properties['SSLCertificateSHA1Hash']) { return $null }
+    return ConvertTo-RdpRepairThumbprintHex -HashValue $p.SSLCertificateSHA1Hash
 }
 
 function Get-RdpRepairSecurityLayer {
@@ -210,7 +244,8 @@ function Test-RdpRepairCertificateBindingPersisted {
     Restart-RdpRepairTermService
     $after = Get-RdpRepairSslCertificateHash
     Write-RdpRepairLog "Hash AFTER TermService start:  $(if ($after) { $after } else { '(empty)' })" 'INFO' $LogPath
-    $ok = ($after -eq $ExpectedThumbprint.ToUpper())
+    $expected = ConvertTo-RdpRepairThumbprintHex -HashValue $ExpectedThumbprint
+    $ok = ($after -eq $expected)
     if ($ok) {
         Write-RdpRepairLog 'Привязка cert принята TermService' 'OK' $LogPath
     } else {