Two-bug root cause confirmed against live arescom.fr Intune tenant: (1) Detection.xml structural deviations (commit7716246) (2) HMAC scope bug — iv+ciphertext vs ciphertext-only (commit74535ea) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>