Resolves the Master Image's configured App Catalog Deploy Groups against the exact same
logic the publish job itself runs, without actually publishing — a read-only preview of what
the next bake would install, for the publish wizard's confirmation step.
Excludes apps that would be skipped at publish time (disabled, no matching installer, or
unsupported on a live host) — this reflects what will actually be installed, not raw
Deploy Group membership.