SPSUpdate: backport #59, #64, #68 fixes to the 4.x line

[luigilink]

Pull Request (PR) description

Backport to the support/4.x (SharePoint 2016 / 2019 / Subscription Edition) maintenance line of three fixes already shipped on main in v5.2.0. These are clean cherry-picks of the original merge commits; the only line-level divergence from main is the pre-existing 4.x SharePoint loader (PSSnapin on 2016/2019, SharePointServer module on SE), so the ported logic is byte-for-byte identical to 5.x:

• Refresh the live Patch Status on the Binaries card after ProductUpdate installs a CU #59 — -Action ProductUpdate refreshes the installed server's live Patch Status on the Binaries Installation card after a real CU install (gated on installPerformed), instead of keeping the pre-install value until the next Default run.
• Run the reboot-confirm boot task as SYSTEM instead of the stored farm credential #64 — the one-shot SPSUpdate-RebootConfirm boot task runs as NT AUTHORITY\SYSTEM (new -RunAsSystem switch on Add-SPSScheduledTask), removing the stored-credential dependency; -Action ConfirmReboot warns clearly when the UNC status-store share does not grant the farm computer accounts Modify.
• Reconcile a deferred reboot already performed out-of-band (manual / Windows Update) #68 — a deferred reboot already performed out-of-band (manual restart / Windows Update) is reconciled (Reboot phase Done, pending marker cleared) instead of restarting the server again; UTC-safe comparison; a fresh reboot required by this run is unaffected.

Not included: the held fix for #71 (PR #72) — it stays on main as DRAFT until validated at the next CU campaign, so it is intentionally excluded from this backport.

Validated locally: PSSA 0 warning/error (2 pre-existing Information findings), Pester 298/0/1.

This Pull Request (PR) fixes the following issues

Backport only — the issues below are already closed by their original main PRs (#67, #66, #69). Listed for traceability; not using a closing keyword on this non-default branch:

• Refresh the live Patch Status on the Binaries card after ProductUpdate installs a CU #59
• Run the reboot-confirm boot task as SYSTEM instead of the stored farm credential #64
• Reconcile a deferred reboot already performed out-of-band (manual / Windows Update) #68

Task list

• Added an entry to the change log under the Unreleased section of the
  file CHANGELOG.md. Entry should say what was changed and how that
  affects users (if applicable), and reference the issue being resolved
  (if applicable).
• Added/updated documentation and descriptions where appropriate?
• New/changed code adheres to [Style Guidelines]?

[github-actions]

Pester Test Results

  1 files   47 suites   12s ⏱️
188 tests 188 ✅ 0 💤 0 ❌
299 runs  299 ✅ 0 💤 0 ❌

Results for commit 0845ee1.

[luigilink]

Files Reviewed