fix(wel): RenderingInfo format bugfix (wrap Keywords, add required Culture)

[Dylan-M]

Proposed Change

The WEL generator emitted non-conformant <RenderingInfo> XML. Two format fixes:

• Wrap <Keyword> in <Keywords> — <Keyword> elements were written
  directly under <RenderingInfo>; the WEL schema requires them inside a
  <Keywords> container.
• Add the required Culture attribute — <RenderingInfo> now renders as
  <RenderingInfo Culture="en-US">. The attribute is required by the schema and
  is always present in real (WEC-forwarded, rendered-text) events.

Validation

• Built an XSD from the MS Learn Event-schema type definitions (EventType,
  SystemPropertiesType, RenderingInfoType) and validated a 1,900+ event
  corpus across all channels: 100% conformant after the fix.
• Cross-checked against a real captured Windows event — both the <Keywords>
  wrapper and Culture="en-US" match real output.

Tests

• Added TestEventRecordToXMLRenderingInfoKeywordsWrapper and
  TestEventRecordToXMLRenderingInfoCulture; updated TestEventRecordToXML.

Out of scope

• RenderingInfo element order (Task before Opcode): intentionally left as-is.
  It matches the real Windows renderer, which diverges from the published XSD
  ordering. Matching the renderer is the realism goal.
• Whether RenderingInfo should be emitted at all (it only appears in
  WEC-forwarded rendered-text events) and locale configurability: tracked as a
  separate follow-up.

Checklist

• Changes are tested
• CI has passed

[Dylan-M]

• fix(wel): RenderingInfo format bugfix (wrap Keywords, add required Culture) #239 👈 (View in Graphite)
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[Dylan-M]

Merge activity

• Jun 9, 7:19 PM UTC: A user started a stack merge that includes this pull request via Graphite.
• Jun 9, 7:19 PM UTC: @Dylan-M added this pull request to the GitHub merge queue with Graphite.