Adds a self-contained governance/ops shell (RdpCoexist/) that drives the
sergiye/rdpWrapper engine to enable concurrent RDP + local console (AnyDesk)
without modifying System32\termsrv.dll on disk (ServiceDll -> TermWrap proxy).
Closes the 5 gaps the bare engine leaves open:
1. No license grant to redistribute the engine -> engine is fetched from its
official release and SHA256-pinned; nothing binary is committed here
(.gitignore blocks engine/, *.exe, *.dll).
2. No self-heal after Windows Update swaps termsrv.dll -> -Heal action plus a
SYSTEM at-startup scheduled task: verify, re-install only if listener dropped.
3. Verification was GUI-only -> -Verify returns a machine-checkable verdict;
COEXIST-OK requires a real 3389 listener AND >=2 active sessions, not just
registry values.
4. Engine phones home / version drift -> engine always invoked with -offline
and the version pinned in config.psd1.
5. Engine DLL flagged HackTool:Win32/RDPWrap -> idempotent Windows Defender
exclusion for the engine folder, skipped gracefully if policy-locked.
Also includes: self-elevating .cmd launcher, GPO-override warning for
fSingleSessionPerUser/fDenyTSConnections, and an optional dedicated local RDP
account (avoids same-user dual-session license traps in OneDrive/Outlook/Office).
All shipped values are neutral placeholders; no environment-specific data.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
P.Choco