feat(install): install.ps1 --from-release parity (Windows cosign verification) #367

Problem

The D4 default-flip (#249) made scripts/install.sh default to the cosign-verified --from-release tarball, with --from-source gated behind --i-accept-unverified-source. This raises the default trust floor on the bash path (macOS/Linux/WSL).

scripts/install.ps1 (Windows) has no --from-release/cosign concept at all — Invoke-Publish unconditionally runs dotnet publish from the local source tree with no signature verification and no acknowledgment gate. #249 explicitly scoped Windows out, which was reasonable at the time, but the D4 flip has now widened the platform trust asymmetry: bash installs are cosign-verified by default; Windows installs have zero verification path.

Surfaced by the code-review-expert pre-PR review of the D4-flip PR.

Scope

Bring install.ps1 to parity with the bash release path:

• -FromRelease (default) / -FromSource -IAcceptUnverifiedSource modes mirroring install.sh.
• Fetch tarball + manifest + sig + cert from the GitHub Release; cosign verify-blob with the same exact-match identity/issuer constants as scripts/verify-release.sh (two identities for the psmfd/TheSemicolon rename).
• Manifest schemaVersion strict-check + tarball sha256 cross-check.
• Downgrade defense + republish guard parity.
• Extract + atomic swap parity.
• A verify-release.ps1 (or reuse via pwsh) sanctioned entrypoint.
• Windows smoke coverage for the release path.

Interim state

install.ps1 remains source-only. Document the asymmetry in the README §Archetype A2 Windows row until parity lands.

Refs

• feat(install): implement ADR-011 — cosign-signed tarball publish + verify-then-extract #249 (D4 default-flip, bash), ADR-011 (Option B), scripts/verify-release.sh, scripts/lib/release-consumer.sh.