fix: Thumbprint при одном cert после нативного сброса (PS 5.1 unwrap)

Добавлены Get-RdpRepairCertificateArray/FirstCertificate, самотесты на вложенные
массивы; Fix-RdpTls больше не использует Select-Object -First 1 на cert.

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/Invoke-RdpRepairSelfTest.ps1

@@ -76,6 +76,30 @@ Assert-Test 'Get-RdpRepairRemoteDesktopCertificates exposes Count' {
     $null = $certs.Count
 }
 
+Assert-Test 'single cert in PSCustomObject keeps Thumbprint' {
+    $mock = [PSCustomObject]@{
+        Thumbprint = 'DEADBEEF'
+        Subject    = 'CN=test'
+        NotAfter   = (Get-Date).AddDays(30)
+        HasKey     = $true
+    }
+    $box = [PSCustomObject]@{ Certificates = @($mock) }
+    $first = Get-RdpRepairFirstCertificate -Certificates $box.Certificates
+    if ($first.Thumbprint -ne 'DEADBEEF') { throw 'Thumbprint lost via property unwrap' }
+}
+
+Assert-Test 'Get-RdpRepairCertificateArray flattens nested Object[]' {
+    $mock = [PSCustomObject]@{
+        Thumbprint = 'NESTED01'
+        Subject    = 'CN=nested'
+        NotAfter   = (Get-Date).AddDays(1)
+        HasKey     = $true
+    }
+    $box = [PSCustomObject]@{ Certificates = ,[object[]]@(,[object[]]@($mock)) }
+    $first = Get-RdpRepairFirstCertificate -Certificates $box.Certificates
+    if ($first.Thumbprint -ne 'NESTED01') { throw "expected NESTED01 got $($first.Thumbprint)" }
+}
+
 Assert-Test 'Get-RdpRepairDiagnosticSnapshot object shape' {
     if (-not (Test-RdpRepairIsAdministrator)) {
         Write-Host '  (skip snapshot fields - not admin)' -ForegroundColor DarkYellow
@@ -85,6 +109,10 @@ Assert-Test 'Get-RdpRepairDiagnosticSnapshot object shape' {
     foreach ($prop in @('ComputerName', 'SecurityLayer', 'CertCount', 'TermService')) {
         if (-not $s.PSObject.Properties[$prop]) { throw "missing property $prop" }
     }
+    if ($s.CertCount -gt 0) {
+        $first = Get-RdpRepairFirstCertificate -Certificates $s.Certificates
+        if (-not $first.Thumbprint) { throw 'snapshot cert missing Thumbprint' }
+    }
 }
 
 Assert-Test 'Registry path constants well-formed' {