feat: PowerShell 7 preflight and launcher - preflight.ps1, wikitool.ps1, doctor policy and Mark of the Web checks, pwsh CI job (#151, B)

Files changed:
- .gitea/workflows/ci.yml
- CHANGES.md
- INSTALL.md
- README.md
- VERSION
- docs/why-gates-are-code.md
- instructions/bootstrap.md
- instructions/bug-report.md
- instructions/preflight.md
- instructions/setup-instance.md
- instructions/upgrade-instance.md
- tools/CONTRACT.md
- tools/README.md
- tools/bugreport.py
- tools/chemenu/cli.py
- tools/chemenu/commands/dist_cmd.py
- tools/chemenu/commands/doctor.py
- tools/chemenu/prerequisites.py
- tools/chemenu/tests/conftest.py
- tools/chemenu/tests/test_bugreport.py
- tools/chemenu/tests/test_doctor.py
- tools/chemenu/tests/test_preflight.py
- tools/chemenu/tests/test_preflight_pwsh.py
- tools/chemenu/toolpaths.py
- tools/preflight.ps1
- tools/wikitool
- tools/wikitool.ps1

tools/README.md

@@ -21,6 +21,10 @@ file deliberately has none - and `docs verify` now enforces that.
 tools/preflight.sh      # from the repo root
 ```
 
+```powershell
+pwsh -NoProfile -ExecutionPolicy Bypass -File tools/preflight.ps1   # PowerShell 7 on Windows
+```
+
 The preflight is the one way a checkout gets its environment: it checks the
 tools listed in `prerequisites.txt`, records their absolute paths in
 `../.wikitool-tools.json`, creates `.venv` and installs `requirements.txt` into
@@ -45,8 +49,10 @@ fix rather than degrading silently.
 ```
 tools/
   wikitool                 entry point (POSIX sh): stops with exit 42 until the preflight has passed
+  wikitool.ps1             the same entry point for PowerShell 7, which resolves `tools/wikitool` to this file first
   run_wikitool.py          what the launcher runs with the venv's Python - puts chemenu on sys.path without PYTHONPATH
   preflight.sh             checks prerequisites.txt, records .wikitool-tools.json, creates .venv (POSIX sh)
+  preflight.ps1            the same for PowerShell 7; also checks the execution policy and the Mark of the Web
   prerequisites.txt        what the machine needs, one `|`-separated line per tool - read by the preflight and `doctor`
   trace-hook               what the harness hooks call: trace_ingest.py under the venv's Python
   chemenu/