Windows event forwarding over mutual auth works, but the subscription content format drops PowerShell script block logs

The channel is healthy, yet investigation quality degrades because the collector-side format setting strips fields one detection depends on.