feat: PowerShell 7 preflight and launcher - preflight.ps1, wikitool.ps1, doctor policy and Mark of the Web checks, pwsh CI job (#151, B)

Files changed:
- .gitea/workflows/ci.yml
- CHANGES.md
- INSTALL.md
- README.md
- VERSION
- docs/why-gates-are-code.md
- instructions/bootstrap.md
- instructions/bug-report.md
- instructions/preflight.md
- instructions/setup-instance.md
- instructions/upgrade-instance.md
- tools/CONTRACT.md
- tools/README.md
- tools/bugreport.py
- tools/chemenu/cli.py
- tools/chemenu/commands/dist_cmd.py
- tools/chemenu/commands/doctor.py
- tools/chemenu/prerequisites.py
- tools/chemenu/tests/conftest.py
- tools/chemenu/tests/test_bugreport.py
- tools/chemenu/tests/test_doctor.py
- tools/chemenu/tests/test_preflight.py
- tools/chemenu/tests/test_preflight_pwsh.py
- tools/chemenu/toolpaths.py
- tools/preflight.ps1
- tools/wikitool
- tools/wikitool.ps1

docs/why-gates-are-code.md

@@ -86,7 +86,7 @@ paragraph it has to remember to apply.
 The preflight is the second such case, and the one closest to this page's own argument. A machine
 without Python or ripgrep is not something the tool can fix, and an install that met that gap
 with only a setup instruction to go on showed what follows: the agent worked around each missing
-piece - another environment, a hand-made configuration - and kept going. So `tools/preflight.sh`
+piece - another environment, a hand-made configuration - and kept going. So `tools/preflight.sh` (and its PowerShell twin, `tools/preflight.ps1`)
 exits 42 with the command a human has to run, and the launcher in front of every `wikitool` call
 exits 42 until the preflight has passed. "Check first, stop, let the user act" lives in two places
 a session cannot read past, not in a step it can skip.