feat(toolkit): add bulk delete tool, fix TUI exit hang and tenant re-prompt

- New Scripts/Bulk-DeletePolicies.ps1: type-DELETE confirmation, -WhatIf dry-run
- Fix infinite loop in Start-IntuneToolkit.ps1 when fzf missing (numbered-menu
  Exit returned "EXIT" but check only matched fzf's "[Exit]" string)
- Start-IntuneManagementTui.ps1 no longer re-prompts for TenantId when the
  launcher already resolved one; also fixes misleading "regex" wording on
  the Name filter prompt (it's a literal substring match)

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

CHANGELOG_macOS_IntuneToolkit.md

@@ -1,5 +1,22 @@
 # macOS Intune Toolkit Changelog
 
+## 2026-08-07 — v4.3.0 — Bulk delete tool and TUI fixes
+
+### Added
+- **`Scripts/Bulk-DeletePolicies.ps1`**
+  - Select object type, filter by name, multi-select objects, and delete them from the tenant.
+  - Requires typing `DELETE` to confirm since the operation is irreversible. Supports `-WhatIf` dry-run.
+  - Wired into `Start-IntuneToolkit.ps1` as menu item **21. Bulk delete policies**.
+
+### Fixed
+- **`Start-IntuneToolkit.ps1`**
+  - Fixed an infinite loop when `fzf` is not installed: the numbered-menu fallback returned `"EXIT"` for the tenant-selection Exit option, but the check only matched the fzf path's `"[Exit]"` string, so choosing Exit was silently ignored and the tenant became the literal string `"EXIT"`.
+- **`Scripts/Private/Start-IntuneManagementTui.ps1`**
+  - The interactive Export/Import/GenerateReports/DeployCISBaseline flow always re-prompted for a Tenant ID even when the tenant was already selected in the outer launcher, because it was invoked with no parameters and had an empty `param()` block. It now accepts `-TenantId` and skips its three tenant prompts when the value is already supplied.
+  - Clarified the "Name filter" prompt text — it's a plain case-insensitive substring match, not a regex (the underlying match escapes the value via `[RegEx]::Escape()`), so the old `'^Win-OIB-'` example was misleading.
+- **`Scripts/Start-HeadlessIntune.ps1`**
+  - Passes `-TenantId` through to `Start-IntuneManagementTui.ps1` so the fix above takes effect.
+
 ## 2026-06-23 — v4.2.0 — Entra directory role membership export
 
 ### Added