Split Windows client bootstrap profiles

tests/BootstrapNetwork.Tests.ps1

@@ -72,6 +72,8 @@ Describe 'SGU public-cloud network safety' {
             'ConnectivityMode') | Should Be $true
         ((Get-Command $clientBootstrapPath).Parameters.Keys -contains
             'VpnProfilePackagePath') | Should Be $true
+        ((Get-Command $clientBootstrapPath).Parameters.Keys -contains
+            'CompatibilityProfile') | Should Be $true
     }
 
     It 'accepts an explicit static IPv4 address for a private Windows adapter' {
@@ -106,6 +108,16 @@ Describe 'SGU public-cloud network safety' {
         $source | Should Match 'Wait-TcpPort -Address \$DomainControllerIPv4Address -Port 5985'
     }
 
+    It 'keeps legacy and modern Windows package profiles isolated by build' {
+        $source = Get-Content -LiteralPath $clientBootstrapPath -Raw
+        $source.Contains("if (`$CompatibilityProfile -eq 'Windows10Legacy' -and `$windowsBuild -ge 22000)") |
+            Should Be $true
+        $source.Contains("if (`$CompatibilityProfile -eq 'Windows11Modern' -and `$windowsBuild -lt 22000)") |
+            Should Be $true
+        $source.Contains("if (`$CompatibilityProfile -eq 'Windows10Legacy' -and `$ConnectivityMode -eq 'AzureP2S')") |
+            Should Be $true
+    }
+
     It 'uses an all-user machine-certificate VPN profile' {
         $source = Get-Content -LiteralPath $azureClientPath -Raw
         $source | Should Match '-AuthenticationMethod MachineCertificate'