Handle valid Defender passive mode separately

[ndemou]

Problem

HealthTest-DefenderStatus requires Microsoft Defender to be in Normal mode with all real-time protection features enabled on every computer.

File: health-tests/HealthTest-DefenderStatus.ps1, lines 28-57.

Defender can legitimately run in passive mode when another antivirus product is active or when the device follows an intentional endpoint-security design. The current test reports several failures without checking that context.

Simple example

A server uses a supported third-party antivirus product. Defender reports AMRunningMode=Passive Mode and its real-time features are off. The test produces several Defender failures even though the active antivirus arrangement may be healthy.

Expected behavior

Distinguish these states:

• Defender is the active antivirus and should be fully enabled;
• Defender is intentionally passive and another protection product is active;
• no active protection can be confirmed;
• status could not be read.

Acceptance criteria

• Valid passive mode is not reported as several unrelated feature failures.
• The result identifies which protection product or mode is active when that can be read.
• Missing active protection still produces a clear problem.
• Unit tests cover active Defender, valid passive mode, and no confirmed protection.