fix(windows): support constrained PowerShell sessions

[Wangnov]

Summary

• replace runtime [pscustomobject] projections with plain hashtables so Authenticode, MSIX install/detection, health, removal, and capability reports remain serializable in PowerShell ConstrainedLanguage
• avoid restricted method calls where the runtime path needs to work under AppLocker/WDAC, while keeping unsupported WinRT capability probes explicitly Unknown
• add Windows-only CLM regression tests for the production Authenticode, capability, MSIX install, and MSIX detection scripts, plus a cross-platform guard against reintroducing the failing cast

Root cause

PowerShell ConstrainedLanguage rejects the [pscustomobject] conversion used to build JSON reports. That caused the report command to exit before the manager could inspect the real Authenticode or installation result, which surfaced as a misleading signature-verification failure. This change keeps the existing fail-closed publisher/signature policy; it only makes report generation compatible with the restricted language mode.

Validation

• npm run check
• npm run lint
• npm test -- --run (118 passed)
• npm run build
• cargo test --manifest-path crates/codex-win-engine/Cargo.toml --all-targets (70 passed)
• cargo check --manifest-path crates/codex-win-engine/Cargo.toml --target x86_64-pc-windows-msvc --all-targets
• cargo clippy --manifest-path src-tauri/Cargo.toml --workspace --all-targets -- -D warnings
• cargo test --manifest-path src-tauri/Cargo.toml --workspace (92 passed)
• codex review on the uncommitted changes: no actionable findings

The Windows CI leg will execute the new Windows-only PowerShell 5.1 ConstrainedLanguage tests.

Closes #178

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.