Fixed operating-system paths for managed configuration.
Return the fixed managed-config path and whether it is authoritative.
What the snapshot loader reads. Callers that report health need this rather
than managed_config_path, so a guessed path is never mistaken for an
authoritative one.
Return the fixed managed-config path for the current operating system.
For display and error messages. Anything that decides whether policy is
enforceable wants resolve_managed_path.
Where managed policy is read from, and whether that location is certain.
fallback holds why the path is a guess, or None when the path is
authoritative. A failed registry query leaves the lookup pointing at the
hardcoded default. On a host whose ProgramData is relocated, the guessed
path holds no file, which reads as "no administrator deployed policy" — the
same state as a machine with no policy at all. The reason travels with the
path so the two can never be confused: a guessed path yields an
INDETERMINATE snapshot rather than a clean MISSING one.
