**Related issue:** Resolves#49418
Adds `patch_when_closed` support to GitOps for patch policies and
round-trips it through `fleetctl generate-gitops`.
- Validate `patch_when_closed` in the patch-policy YAML: reject an
explicit `continuous_automations_enabled: false` alongside it (GitOps is
declarative — the datastore would otherwise silently force it on),
auto-set it when omitted, and reject a `pre_install_query` on the
referenced Fleet-maintained app (Fleet manages that query).
- Emit `patch_when_closed` from `fleetctl generate-gitops`.
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
## New Fleet configuration settings
Follow this checklist for GitOps-enabled settings:
- [x] Verified that the setting is exported via `fleetctl
generate-gitops`
- [x] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md)
(#49022)
- [x] Verified that the setting is cleared on the server if it is not
supplied in a YAML file
---------
Co-authored-by: Jonathan Katz <yehonatankatz@gmail.com>
