chore(rules,agent): allowlist RealmJoin registry prefixes + bump build counters (Phase E)

- rules/guardrails.json: add new "RealmJoin" category covering
  SYSTEM\CurrentControlSet\Services\realmjoin and SOFTWARE\RealmJoin. Hive-agnostic
  match covers HKLM\SYSTEM\..., HKLM\SOFTWARE\RealmJoin, and HKU\<sid>\SOFTWARE\RealmJoin
  so operator-authored Gather-rules can probe the RJ keys (the RealmJoinWatcher
  itself bypasses GatherRuleGuards and watches the registry directly).
- src/Web/autopilot-monitor-web/lib/guardrails.generated.ts: regenerated via
  node rules/scripts/combine.js so the Web admin UI surface matches the new
  registry allowlist.
- buildcounter.txt (V2 + V1): auto-incremented by the Phase A-D builds.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

rules/guardrails.json

@@ -77,6 +77,13 @@
       "prefixes": [
         "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Component Based Servicing"
       ]
+    },
+    {
+      "category": "RealmJoin",
+      "prefixes": [
+        "SYSTEM\\CurrentControlSet\\Services\\realmjoin",
+        "SOFTWARE\\RealmJoin"
+      ]
     }
   ],
   "filePrefixes": [

src/Agent/AutopilotMonitor.Agent.V2/buildcounter.txt

@@ -1 +1 @@
-842
+848

src/Agent/AutopilotMonitor.Agent/buildcounter.txt

@@ -1 +1 @@
-1391
+1393

src/Web/autopilot-monitor-web/lib/guardrails.generated.ts

@@ -91,6 +91,13 @@ export const REGISTRY_PREFIX_CATEGORIES: readonly GuardrailCategory[] = [
       "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Component Based Servicing",
     ],
   },
+  {
+    category: "RealmJoin",
+    items: [
+      "SYSTEM\\CurrentControlSet\\Services\\realmjoin",
+      "SOFTWARE\\RealmJoin",
+    ],
+  },
 ];
 
 export const COMMAND_CATEGORIES: readonly GuardrailCategory[] = [
@@ -174,6 +181,8 @@ export const ALLOWED_REGISTRY_PREFIXES: readonly string[] = [
   "SOFTWARE\\Microsoft\\SystemCertificates",
   "SOFTWARE\\Policies\\Microsoft\\SystemCertificates",
   "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Component Based Servicing",
+  "SYSTEM\\CurrentControlSet\\Services\\realmjoin",
+  "SOFTWARE\\RealmJoin",
 ];
 
 export const ALLOWED_FILE_PREFIXES: readonly string[] = [