P1: install FAT V2 schema before first paint

[masarray]

Recovery stage P1

Stacked directly on P0 c5fc74e2211c72f23ddb368f9bfb2a76ae2f0df5 (fix/p0-1888-fat-recovery).

Scope

• Install the existing FAT V2 workspace schema during Loaded, before the first visible render.
• First FAT paint therefore uses the V2 evidence schema (LIVE VALUE | VALUE 1 | VALUE 2) instead of briefly painting legacy relay-time columns from XAML.
• Reuse the existing idempotent InstallFatV2WorkspaceUx() path; the later ContentRendered compatibility call does not rebuild columns once P1 has installed them.
• Add regression guards for Loaded timing, V2 schema identity, idempotence, and no virtualization/protocol/evidence mutation.

Frozen / unchanged

• P0 runtime projection and Boolean canonicalization.
• Analog auto-capture.
• Command defaults / Command Panel.
• Static DataSet / RCB signal authority.
• FAT evidence semantics and lifecycle.
• ARIEC61850 engine/pin.
• No runtime virtualization mutation.

Gate

Do not merge this stacked recovery PR until CI is green and the physical relay bench confirms the FAT window opens directly with the V2 schema and no legacy-column flash.

[masarray]

P1 gate complete on head e1045eb6c4c2c0899395c57c9ca2a01e1f7c352b.

Final diff vs P0 c5fc74e2211c72f23ddb368f9bfb2a76ae2f0df5: only 2 files changed — IoListTestingWindow.P1FirstPaint.cs and tests/ARSAS.Tests/IoFatP1FirstPaintRegressionTests.cs.

Final CI:

• Build ARSAS #1921 — success (run 34005104554), including solution build, regression tests, portable publish and smoke-test gate.
• Validate IO List Testing #794 — success (run 34005104561), 236 focused tests after correcting a test-only guard that initially matched a comment string.
• Validate SV evidence bundles #1019 — success (run 34005104563).

P1 production behavior: the existing idempotent FAT V2 installer now runs on the Window Loaded class handler, before first visible render. No runtime virtualization mutation, protocol acquisition, evidence capture, command, static DataSet/RCB, or ARIEC61850 changes.

PR remains draft and MUST NOT be merged until physical relay bench confirms there is no legacy ON/OFF RELAY TIME first-paint flash and the FAT opens directly with LIVE VALUE | VALUE 1 | VALUE 2.