fix: Thumbprint при одном cert после нативного сброса (PS 5.1 unwrap)

Добавлены Get-RdpRepairCertificateArray/FirstCertificate, самотесты на вложенные
массивы; Fix-RdpTls больше не использует Select-Object -First 1 на cert.

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/Fix-RdpTls.ps1

@@ -71,7 +71,7 @@ try {
             Write-RdpRepairLog 'No cert in Remote Desktop store - run full repair or repair install first' 'ERROR' $logPath
             exit 2
         }
-        $valid = $certs | Where-Object { $_.NotAfter -gt (Get-Date) } | Select-Object -First 1
+        $valid = @(Get-RdpRepairCertificateArray $certs | Where-Object { $_.NotAfter -gt (Get-Date) })[0]
         if (-not $valid) {
             Write-RdpRepairLog 'Все cert просрочены' 'ERROR' $logPath
             exit 2
@@ -98,7 +98,7 @@ try {
     $snap = Get-RdpRepairDiagnosticSnapshot
     $snap | Format-List ComputerName, OsCaption, SecurityLayer, SslHash, CertCount, Events1057_24h, GpoLicenseSrv
 
-    $expired = @($snap.Certificates | Where-Object { $_.NotAfter -lt (Get-Date) })
+    $expired = @(Get-RdpRepairCertificateArray $snap.Certificates | Where-Object { $_.NotAfter -lt (Get-Date) })
     if ($expired.Count -gt 0) {
         Write-RdpRepairLog "Найдено просроченных cert: $($expired.Count)" 'WARN' $logPath
     }
@@ -111,7 +111,8 @@ try {
     $native = Invoke-RdpRepairNativeReset -LogPath $logPath
     if ($native.CertCount -gt 0) {
         Write-RdpRepairLog "После сброса без reboot: нативный cert найден ($($native.CertCount))" 'OK' $logPath
-        $nativeCert = $native.Certificates | Select-Object -First 1
+        $nativeCert = Get-RdpRepairFirstCertificate -Certificates $native.Certificates
+        if (-not $nativeCert) { throw 'Native cert list empty after reset' }
         $bindNative = Test-RdpRepairCertificateBindingPersisted -ExpectedThumbprint $nativeCert.Thumbprint -LogPath $logPath
         if ($bindNative.Persisted) {
             Write-RdpRepairLog 'Native cert accepted - you can use RestoreTls' 'OK' $logPath