Let deletable_admins match a name prefix ending in *

[rodchristiansen]

deletable_admins matched account names exactly. A family of numbered admin accounts had to be listed one by one, and an entry for the base name never matched its numbered siblings. admin-* could not be expressed.

What changed

• New DeletableAdminMatcher: an entry is an exact name, or a prefix ending in a single *. Both match case-insensitively. admin-* matches admin-1 and Admin-Lab, not admin or admin-.
• A bare *, or a * anywhere but the end, is ignored and the run logs a warning, because it would opt every admin in and lift the delete_admins guard.
• Exclusions still win: an excluded account never matches, whatever the list says.
• delete_admins: false stays the guard. The list is consulted only for accounts that are local admins while the guard is on, in both the main pass and the orphan pass.
• README gains an Administrators section with a table of entry forms. The Prefs placeholder and the PolicyConfig doc comment mention the prefix form.

Testing

• New DeletableAdminMatcherTests cover exact and prefix matching, case, exclusions winning, rejected * forms, blanks and duplicates. All 10 pass on macOS when compiled against net10.0 with just the matcher and its tests.
• The CLI and test project cross-build for net10.0-windows on macOS with no warnings. Windows CI builds the whole solution, WinUI app included, and runs the full suite: 86/86 pass.

Before merging

• CI is green on Windows: build clean, full suite 86/86 passing.
• Check that the fleet's deletable_admins lists contain no entry with a * that should be read literally. None is expected, since account names cannot contain *.
• An entry like admin* does not match a bare admin. Keep the exact entry beside the prefix when both should be deletable.