feat(02-03): implement buildIntuneInstall and buildIntuneDetection

- buildIntuneInstall: UTF-8 no-BOM write via WriteAllText, PS here-string for config, conditional rclone download block
- buildIntuneDetection: no $ErrorActionPreference, Write-Output + exit 0/1 pattern
- Both generators use CONFIG_DIR from ps-helpers for consistent path resolution
- All 15 intune-install and intune-detection tests pass GREEN

src/generators/intune-detection.ts

@@ -0,0 +1,30 @@
+// src/generators/intune-detection.ts
+// Generates a PowerShell detection script for Microsoft Intune compliance checks.
+//
+// CRITICAL design constraints (from Microsoft Learn):
+//   - Exit 0 + Write-Output  → app detected (compliant)
+//   - Any STDERR output      → app NOT detected, even with exit 0
+//   - Therefore: NO $ErrorActionPreference = 'Stop' here — unhandled exceptions
+//     write to STDERR, which Intune interprets as non-detection regardless of exit code
+//   - NO Write-Error, NO Write-Host (Write-Host goes to the information stream in PS 5+,
+//     which Intune may capture differently depending on host; Write-Output is safest)
+
+import type { WizardState } from '../store/types';
+import { CONFIG_DIR } from './ps-helpers';
+
+export function buildIntuneDetection(state: WizardState): string {
+  const configDir = CONFIG_DIR[state.deployment.configPath];
+
+  return [
+    `$configDir = '${configDir}'`,
+    `$rclonePath = "$configDir\\rclone.exe"`,
+    `$configPath = "$configDir\\rclone.conf"`,
+    ``,
+    `if ((Test-Path $rclonePath) -and (Test-Path $configPath)) {`,
+    `    Write-Output "rclone and config detected"`,
+    `    exit 0`,
+    `} else {`,
+    `    exit 1`,
+    `}`,
+  ].join('\n') + '\n';
+}