feat: PowerShell 7 preflight and launcher - preflight.ps1, wikitool.ps1, doctor policy and Mark of the Web checks, pwsh CI job (#151, B)

Files changed:
- .gitea/workflows/ci.yml
- CHANGES.md
- INSTALL.md
- README.md
- VERSION
- docs/why-gates-are-code.md
- instructions/bootstrap.md
- instructions/bug-report.md
- instructions/preflight.md
- instructions/setup-instance.md
- instructions/upgrade-instance.md
- tools/CONTRACT.md
- tools/README.md
- tools/bugreport.py
- tools/chemenu/cli.py
- tools/chemenu/commands/dist_cmd.py
- tools/chemenu/commands/doctor.py
- tools/chemenu/prerequisites.py
- tools/chemenu/tests/conftest.py
- tools/chemenu/tests/test_bugreport.py
- tools/chemenu/tests/test_doctor.py
- tools/chemenu/tests/test_preflight.py
- tools/chemenu/tests/test_preflight_pwsh.py
- tools/chemenu/toolpaths.py
- tools/preflight.ps1
- tools/wikitool
- tools/wikitool.ps1

tools/wikitool

@@ -9,9 +9,10 @@
 #
 # Nothing here sets up an environment. tools/preflight.sh does that, once per
 # checkout and again after every stack update: it records the tool paths in
-# .wikitool-tools.json and creates tools/.venv. Until it has passed, this script
-# stops with exit 42 and names it - the preflight is the one step that must not
-# be skipped or improvised around (instructions/preflight.md).
+# .wikitool-tools.json and creates tools/.venv (tools/preflight.ps1 is its
+# PowerShell twin). Until it has passed, this script stops with exit 42 and
+# names it - the preflight is the one step that must not be skipped or
+# improvised around (instructions/preflight.md).
 set -eu
 DIR=$(CDPATH='' cd -- "$(dirname -- "$0")" && pwd -P)
 ROOT=$(dirname -- "$DIR")
@@ -34,6 +35,10 @@ paths and creates tools/.venv:
 
   tools/preflight.sh
 
+From PowerShell 7 (Windows), run this one instead:
+
+  pwsh -NoProfile -ExecutionPolicy Bypass -File tools/preflight.ps1
+
 It exits 0 when everything is in place. If it exits 42, show its output to the
 user as it is and wait - it says what to do. See instructions/preflight.md.
 EOF