release: v4.1.0 — restructure entry points, add CIS baselines, reporting tools and fzf hints

- Restructure launchers: Start-IntuneToolkit.ps1 moves to repo root;
  Start-HeadlessIntune.ps1 moves to Scripts/; TUI helper moves to Scripts/Private/
- Add AGENTS.md with project architecture, entry points, and security notes
- Add CIS M365 baseline assets (CISM365-v7, M365-CIS-Rapid) and reporting scripts
- Add Python reporting utilities (Export-SettingsReport, Export-AssignmentReport,
  Export-ObjectInventoryReport) and CA wizard helpers
- Update Deploy-IntuneBaseline.ps1 with Merge conflict resolution, ReportPath,
  and optimized group loading
- Update Initialize-IntuneAuth.ps1 with -RotateSecret and configurable secret expiry
- Update Extensions for Settings Catalog definition auto-export
- Update README with v4.1.0, new entry points and script catalog
- Bump VERSION to 4.1.0
- Harden .gitignore against .DS_Store, __pycache__, .venv-pdf/, local exports,
  Settings.json and IntuneManagement.log

Scripts/ConvertFrom-CISPDF.ps1

@@ -0,0 +1,74 @@
+#requires -Version 7.0
+<#
+.SYNOPSIS
+    Converts a CIS M365 Benchmark v7.0.0 PDF into a YAML baseline manifest.
+
+.DESCRIPTION
+    Extracts text from the draft CIS PDF, parses recommendations, and generates
+    a CISM365-v7.yaml baseline file ready for Deploy-CISM365Baseline.ps1.
+
+    Prerequisites:
+    - Python 3 with pypdf installed (script will create venv if needed)
+    - The draft PDF at the specified path
+
+.PARAMETER PdfPath
+    Path to the CIS M365 v7.0.0 draft PDF.
+
+.PARAMETER OutputPath
+    Path for the generated YAML file. Defaults to ./Baselines/CISM365-v7-Generated.yaml
+
+.PARAMETER Prefix
+    Optional naming prefix for all generated policies.
+
+.EXAMPLE
+    ./Scripts/ConvertFrom-CISPDF.ps1 -PdfPath ~/Downloads/DRAFT_CIS_Microsoft_365_Foundations_Benchmark_v7.0.0.pdf
+#>
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory = $true)]
+    [string]$PdfPath,
+
+    [Parameter()]
+    [string]$OutputPath = "$PSScriptRoot/../Baselines/CISM365-v7-Generated.yaml",
+
+    [Parameter()]
+    [string]$Prefix = "CIS-v7-",
+
+    [Parameter()]
+    [ValidateSet('L1','L2','Both')]
+    [string]$Level = 'Both',
+
+    [Parameter()]
+    [ValidateSet('E3','E5','Both')]
+    [string]$License = 'Both'
+)
+
+$ErrorActionPreference = 'Stop'
+
+# Resolve paths
+$pdfPathResolved = Resolve-Path $PdfPath | Select-Object -ExpandProperty Path
+$outputPathResolved = $ExecutionContext.SessionState.Path.GetUnresolvedProviderPathFromPSPath($OutputPath)
+
+# Ensure Python venv exists
+$venvPath = "$PSScriptRoot/../.venv-pdf"
+$pythonExe = "$venvPath/bin/python3"
+
+if (-not (Test-Path $pythonExe)) {
+    Write-Host "Creating Python virtual environment..." -ForegroundColor Yellow
+    python3 -m venv $venvPath
+    & "$venvPath/bin/pip" install pypdf | Out-Null
+}
+
+$pyScript = "$PSScriptRoot/_ConvertFrom-CISPDF.py"
+if (-not (Test-Path $pyScript)) {
+    throw "Python converter script not found: $pyScript"
+}
+
+Write-Host "Converting PDF to YAML baseline..." -ForegroundColor Cyan
+& $pythonExe $pyScript $pdfPathResolved $outputPathResolved $Prefix $Level $License
+
+if ($LASTEXITCODE -eq 0) {
+    Write-Host "Done. Review the generated file before deploying." -ForegroundColor Green
+} else {
+    throw "PDF conversion failed."
+}