Managed-settings policy helper can be "armed from remote"

The policy-helper resolver now returns { helper, remoteArmed }, with remoteArmed defaulting to true unless the source says otherwise. When armed remotely, the reported settings tier shows as "remote" instead of "helper", and the settings-source display can read "Enterprise managed settings (remote helper)" as a distinct case from the local helper or default payload. The helper store gained remoteArmGeneration, remoteArmingConfig and remoteNoticeSubject, and tier changes now go through a dedicated method rather than an ad-hoc callback.

policyHelpers joins the recognised helper settings list alongside gcpAuthRefresh, otelHeadersHelper, processWrapper, proxyAuthHelper, statusLine and subagentStatusLine. The policy-origin resolver now derives origin from the settings source, including a new helperArmedFromRemote source and an armedFromRemote field on the managed-settings snapshot. The shell-environment fingerprint now expands policyHelpers into per-OS entries with a hashed value (policyHelpers.<os>=<hash>) instead of a bare key.