feat: PowerShell 7 preflight and launcher - preflight.ps1, wikitool.ps1, doctor policy and Mark of the Web checks, pwsh CI job (#151, B)

Files changed:
- .gitea/workflows/ci.yml
- CHANGES.md
- INSTALL.md
- README.md
- VERSION
- docs/why-gates-are-code.md
- instructions/bootstrap.md
- instructions/bug-report.md
- instructions/preflight.md
- instructions/setup-instance.md
- instructions/upgrade-instance.md
- tools/CONTRACT.md
- tools/README.md
- tools/bugreport.py
- tools/chemenu/cli.py
- tools/chemenu/commands/dist_cmd.py
- tools/chemenu/commands/doctor.py
- tools/chemenu/prerequisites.py
- tools/chemenu/tests/conftest.py
- tools/chemenu/tests/test_bugreport.py
- tools/chemenu/tests/test_doctor.py
- tools/chemenu/tests/test_preflight.py
- tools/chemenu/tests/test_preflight_pwsh.py
- tools/chemenu/toolpaths.py
- tools/preflight.ps1
- tools/wikitool
- tools/wikitool.ps1

tools/wikitool.ps1

@@ -0,0 +1,54 @@
+#Requires -Version 7
+# Entry point for the wikitool CLI under PowerShell 7, so agents and people invoke it
+# through the same string on every platform:
+#
+#   tools/wikitool <command> [options]
+#
+# PowerShell resolves that to this file first. Without it, `tools/wikitool` is the sh
+# launcher next to it, which PowerShell does not run: the command would end silently
+# without printing anything. The POSIX half - Linux, macOS and Git Bash - is tools/wikitool.
+#
+# Nothing here sets up an environment. tools/preflight.ps1 does that, once per checkout and
+# again after every stack update: it records the tool paths in .wikitool-tools.json and
+# creates tools/.venv. Until it has passed, this script stops with exit 42 and names it -
+# the preflight is the one step that must not be skipped or improvised around
+# (instructions/preflight.md).
+
+Set-StrictMode -Version Latest
+$ErrorActionPreference = 'Stop'
+$PSNativeCommandArgumentPassing = 'Standard'
+
+$Dir = $PSScriptRoot
+$Root = Split-Path -Parent $Dir
+$ToolsFile = Join-Path $Root '.wikitool-tools.json'
+
+# Both venv layouts: Scripts\ on Windows, bin/ everywhere else.
+$Python = ''
+foreach ($candidate in @((Join-Path $Dir '.venv/Scripts/python.exe'), (Join-Path $Dir '.venv/bin/python'))) {
+    if (Test-Path -LiteralPath $candidate -PathType Leaf) {
+        $Python = $candidate
+        break
+    }
+}
+
+$Complete = (Test-Path -LiteralPath $ToolsFile -PathType Leaf) -and
+    ((Get-Content -Raw -LiteralPath $ToolsFile) -match '"complete":\s*true')
+
+if (-not $Python -or -not $Complete) {
+    [Console]::Error.WriteLine(@'
+STOP - this checkout is not set up yet (or no longer after an update).
+Run the preflight first; it checks what this computer has, records the tool
+paths and creates tools/.venv:
+
+  pwsh -NoProfile -ExecutionPolicy Bypass -File tools/preflight.ps1
+
+It exits 0 when everything is in place. If it exits 42, show its output to the
+user as it is and wait - it says what to do. See instructions/preflight.md.
+'@)
+    exit 42
+}
+
+# Do not change into $Dir: that would resolve relative CLI arguments (for example
+# --markdown "kb/Lint Report.md") against tools/ instead of the caller's directory.
+& $Python (Join-Path $Dir 'run_wikitool.py') @args
+exit $LASTEXITCODE