fix(agent/v2/sw-inventory): include AAD/MSA SIDs and emit real registry path in logs

- Filter in CollectFromAllUserProfiles now also accepts S-1-12-1-* SIDs (Microsoft Account / Azure AD cloud SIDs on Win10 1903+ AAD-joined devices); previously only S-1-5-21-* matched, so the per-user Uninstall hive of the actually-logged-in AAD user was silently skipped on Win11 AAD-joined machines.
- CollectFromKey log line now uses rootKey.Name (HKEY_LOCAL_MACHINE / HKEY_USERS / ...) as the path prefix and reports the telemetry tag separately as "(source=...)". Removes the misleading "HKU_1000\S-1-5-21-...\SOFTWARE\..." Frankenstein-path that mashed the label with the subkey path.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Telemetry/Analyzers/SoftwareInventoryAnalyzer.cs

@@ -197,13 +197,16 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Analyzers
 
         private void CollectFromKey(RegistryKey rootKey, string subKeyPath, string source, List<SoftwareEntry> results)
         {
+            // rootKey.Name yields the canonical hive name (HKEY_LOCAL_MACHINE / HKEY_USERS / …),
+            // so the log line is a real registry path. `source` is a separate telemetry tag
+            // (e.g. HKLM_64, HKU_<RID>) used as RegistrySource on the SoftwareEntry.
             try
             {
                 using (var key = rootKey.OpenSubKey(subKeyPath, writable: false))
                 {
                     if (key == null)
                     {
-                        _logger.Debug($"{Name}: Registry key not found: {source}\\{subKeyPath}");
+                        _logger.Debug($"{Name}: Registry key not found: {rootKey.Name}\\{subKeyPath} (source={source})");
                         return;
                     }
 
@@ -246,7 +249,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Analyzers
             }
             catch (Exception ex)
             {
-                _logger.Warning($"{Name}: Failed to read {source}\\{subKeyPath}: {ex.Message}");
+                _logger.Warning($"{Name}: Failed to read {rootKey.Name}\\{subKeyPath} (source={source}): {ex.Message}");
             }
         }
 
@@ -271,8 +274,12 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Analyzers
 
                     foreach (var sid in profileList.GetSubKeyNames())
                     {
-                        // Only real user profiles (S-1-5-21-*), skip well-known SIDs
-                        if (!sid.StartsWith("S-1-5-21-", StringComparison.OrdinalIgnoreCase))
+                        // Real user profiles only:
+                        //   S-1-5-21-*  classic local/AD user accounts
+                        //   S-1-12-1-*  Microsoft Account / Azure AD cloud SIDs (Win10 1903+ AAD-joined devices)
+                        // Skip well-known service SIDs (S-1-5-18/19/20) and everything else.
+                        if (!sid.StartsWith("S-1-5-21-", StringComparison.OrdinalIgnoreCase) &&
+                            !sid.StartsWith("S-1-12-1-", StringComparison.OrdinalIgnoreCase))
                             continue;
 
                         // Skip current user SID — already covered by HKCU read above

src/Agent/AutopilotMonitor.Agent.V2/buildcounter.txt

@@ -1 +1 @@
-638
+640