feat(apps-expose): Add INCLUDED_APPS allowlist mode + Power BI Desktop / Excel examples

[Copilot]

Adds a second filter mode (FILTER_MODE=include) to the apps-expose service so operators can define an explicit allowlist instead of maintaining a growing denylist. Default behaviour (exclude) is unchanged.

Changes

parallels_apps_expose_service.sh

• FILTER_MODE env var (default: "exclude") — zero impact on existing installs
• INCLUDED_APPS array with commented-out "Power BI Desktop" / "Excel" entries as a ready-to-use starting point
• is_included() — regex-anchored pattern matcher, mirrors is_excluded()
• should_expose() — single dispatch replacing direct is_excluded() calls in both cleanup and discovery loops
• validate_config() — startup warning when FILTER_MODE=include but INCLUDED_APPS is empty

README.md

• New Filter Mode section: comparison table, per-mode examples using Power BI Desktop / Excel, [!WARNING] callout for empty-allowlist misconfiguration

# Allowlist mode — only these two apps appear in Windows Apps folder
FILTER_MODE=include

INCLUDED_APPS=(
    "Power BI Desktop"
    "Excel"
)

Type of change

• New feature (non-breaking change which adds functionality)
• This change requires a documentation update

Checklist:

• I have performed a self-review of my own code
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have run tests that prove my fix is effective or that my feature works