Add ndOffice (NetDocuments) app support

[allenhouchins]

Introduce ndOffice (NetDocuments) as a maintained app: add a winget input manifest (ee/maintained-apps/inputs/winget/ndoffice.json) and corresponding install/uninstall PowerShell scripts. The install script extracts the provided ZIP and runs the nested MSI via msiexec; the uninstall script locates the MSI product code from the registry and uninstalls silently.

Add outputs: register the app in ee/maintained-apps/outputs/apps.json and add a platform-specific versions file with installer URL, sha256 and embedded script refs. Also add a frontend SVG/PNG icon component and image asset, and wire the icon into the SoftwarePage icon index mapping.

Related issue: Resolves #46498

Checklist for submitter

If some of the following don't apply, delete the relevant line.

• Changes file added for user-visible changes in changes/, orbit/changes/ or ee/fleetd-chrome/changes.
  See Changes files for more information.

• Input data is properly validated, SELECT * is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters.

• Timeouts are implemented and retries are limited to avoid infinite loops

• If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes

Testing

• Added/updated automated tests

• Where appropriate, automated tests simulate multiple hosts and test for host isolation (updates to one hosts's records do not affect another)

• QA'd all new/changed functionality manually

For unreleased bug fixes in a release candidate, one of:

• Confirmed that the fix is not expected to adversely impact load test results
• Alerted the release DRI if additional load testing is needed

Database migrations

• Checked schema for all modified table for columns that will auto-update timestamps during migration.
• Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects.
• Ensured the correct collation is explicitly set for character columns (COLLATE utf8mb4_unicode_ci).

New Fleet configuration settings

• Setting(s) is/are explicitly excluded from GitOps

If you didn't check the box above, follow this checklist for GitOps-enabled settings:

• Verified that the setting is exported via fleetctl generate-gitops
• Verified the setting is documented in a separate PR to the GitOps documentation
• Verified that the setting is cleared on the server if it is not supplied in a YAML file (or that it is documented as being optional)
• Verified that any relevant UI is disabled when GitOps mode is enabled

fleetd/orbit/Fleet Desktop

• Verified compatibility with the latest released version of Fleet (see Must rule)
• If the change applies to only one platform, confirmed that runtime.GOOS is used as needed to isolate changes
• Verified that fleetd runs on macOS, Linux and Windows
• Verified auto-update works from the released version of component to the new version (see tools/tuf/test)

[codecov]

Codecov Report

❌ Patch coverage is 50.00000% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 67.23%. Comparing base (0ceed8e) to head (2dac31a).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
...d/pages/SoftwarePage/components/icons/Ndoffice.tsx	50.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #47942      +/-   ##
==========================================
- Coverage   67.24%   67.23%   -0.01%     
==========================================
  Files        3652     3653       +1     
  Lines      230538   230540       +2     
  Branches    12129    11983     -146     
==========================================
+ Hits       155014   155015       +1     
- Misses      61607    61609       +2     
+ Partials    13917    13916       -1     

Flag	Coverage Δ
frontend	58.10% <50.00%> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[allenhouchins]

The core issue: ndOffice is an Office add-in with two hard prerequisites — Microsoft Office and the VSTO Runtime — that the Fleet validator host (a clean machine) doesn't have. The MSI is designed to hard-abort without them. This is the same class of problem as a macOS pkg-only tool with no .app bundle: technically packageable, but it can't pass validation, and on any real host lacking Office the install is either blocked or pointless.