fix(windows): defer missing tray task during trust reset

agents/windows/install.ps1

@@ -953,6 +953,19 @@ function Get-MinerOpsScheduledTask {
     return $tasks[0]
 }
 
+function Test-MinerOpsInstallerShouldCreateMissingTask {
+    param(
+        [Parameter(Mandatory)]$Definition,
+        [Parameter(Mandatory)][bool]$TrustResetMode
+    )
+
+    if (-not $TrustResetMode) { return $true }
+    if ($null -eq $Definition.CreateWhenMissingDuringTrustReset) {
+        throw "Scheduled Task trust-reset creation policy is missing."
+    }
+    return [bool]$Definition.CreateWhenMissingDuringTrustReset
+}
+
 function Stop-MinerOpsScheduledTaskForUpgrade {
     param(
         [Parameter(Mandatory)][string]$Name,
@@ -1101,22 +1114,26 @@ try {
             Name = "MinerOpsAgent"; Script = "MinerOpsAgentService.ps1"
             Trigger = $startup; Principal = $system; Settings = $agentSettings
             ExtraArguments = ""
+            CreateWhenMissingDuringTrustReset = $true
         },
         @{
             Name = "MinerOpsAgentTray"; Script = "MinerOpsAgentTray.ps1"
             Trigger = (New-ScheduledTaskTrigger -AtLogOn); Principal = $null
             Settings = $commonSettings; ExtraArguments = "-WindowStyle Hidden"
+            CreateWhenMissingDuringTrustReset = $false
         },
         @{
             Name = "MinerOpsApi3Enrichment"
             Script = "MinerOpsApi3EnrichmentPoller.ps1"
             Trigger = $fiveMinutes; Principal = $system; Settings = $commonSettings
             ExtraArguments = "-Limit 0 -TimeoutMs 8000"
+            CreateWhenMissingDuringTrustReset = $true
         },
         @{
             Name = "MinerOpsPoolPoller"; Script = "MinerOpsPoolPollerTask.ps1"
             Trigger = $fiveMinutes; Principal = $system; Settings = $commonSettings
             ExtraArguments = ""
+            CreateWhenMissingDuringTrustReset = $true
         }
     )
     foreach ($definition in $definitions) {
@@ -1129,6 +1146,16 @@ try {
             continue
         }
 
+        if (-not (Test-MinerOpsInstallerShouldCreateMissingTask `
+            -Definition $definition -TrustResetMode $trustResetMode)) {
+            # Trust-reset publication can run noninteractively as SYSTEM. A
+            # missing per-user tray has no safe interactive principal in that
+            # context. Its runtime file is already published; task creation is
+            # intentionally deferred to a later interactive maintenance run.
+            Write-Host "Deferring missing per-user Scheduled Task $($definition.Name) until an interactive install."
+            continue
+        }
+
         $arguments = '-NoProfile -ExecutionPolicy Bypass -File "{0}"' -f `
             (Join-Path $Target $definition.Script)
         if ($definition.ExtraArguments) {