bfe6a7a2ab
Use PROCESS_QUERY_LIMITED_INFORMATION + QueryFullProcessImageNameW instead of WMI Win32_Process. Reduces process enumeration from ~3s to ~8ms. All user-facing applications are detected; only protected system services are not visible (irrelevant for profile conditions). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>