fix(BG0575): the Windows control reads its own fixture, so the PowerShell half can actually be verified

The `windows-smoke` step added for BG0575 failed on its first real run, in the green control:

  Failed to reach .../v9.9.9/sdlc-studio-v9.9.9.zip - a transport error, not a missing
  asset. Refusing to fall back to an unverified download. Cannot bind argument to
  parameter 'Path' because it is null.

The function shadow worked - `install.ps1` did call the stub rather than the real
`Invoke-WebRequest`. What did not work is `$script:`: once `install.ps1` is invoked with `&` it
is its own script, and the stub's `$script:AssetZip` resolved against THAT scope rather than the
step's, so it read null, `Copy-Item` threw, and `install.ps1` correctly reported a transport
error. The installer behaved exactly as designed; the fixture was lying to it.

Rescoped to `$global:`, which is unambiguous across an invoked script boundary.

Worth recording rather than fixing quietly: the fix review predicted this exact area and asked
whether the shadow would apply. It does. I checked the half that was raised and not the half
beside it - the variables - which is the shape of LL0052.

BG0575 stays OPEN until this step reports green. Its Verification depth says the PowerShell half
must be demonstrated green-and-red in CI before the bug closes, and a bug closed against its own
recorded criterion is worth less than one left open.

Refs: BG0575

Author: DarrenBenson

.github/workflows/lint.yml

@@ -230,16 +230,16 @@ jobs:
           # survive this whole job while breaking every real verified install on Windows.
           $digest = (Get-FileHash -Path $zip -Algorithm SHA256).Hash.ToLower()
 
-          $script:ServedDigest = $digest
-          $script:AssetZip = $zip
+          $global:ServedDigest = $digest
+          $global:AssetZip = $zip
 
           function Invoke-WebRequest {
             param([string]$Uri, [string]$OutFile, [switch]$UseBasicParsing)
             if ($Uri -like '*/releases/download/*sdlc-studio-v9.9.9.zip.sha256') {
-              return [pscustomobject]@{ Content = "$script:ServedDigest  sdlc-studio-v9.9.9.zip" }
+              return [pscustomobject]@{ Content = "$global:ServedDigest  sdlc-studio-v9.9.9.zip" }
             }
             if ($Uri -like '*/releases/download/*sdlc-studio-v9.9.9.zip') {
-              Copy-Item $script:AssetZip $OutFile -Force; return
+              Copy-Item $global:AssetZip $OutFile -Force; return
             }
             # Anything else is "not there". install.ps1 reads the status off
             # $_.Exception.Response.StatusCode, so the thrown exception must actually CARRY one -
@@ -261,7 +261,7 @@ jobs:
           Pop-Location
 
           # RED control: corrupt the sidecar. The install must abort before extraction.
-          $script:ServedDigest = 'deadbeef'
+          $global:ServedDigest = 'deadbeef'
           $proj2 = Join-Path $work 'proj2'
           New-Item -ItemType Directory -Force $proj2 | Out-Null
           Push-Location $proj2
@@ -279,8 +279,7 @@ jobs:
           # 404 branch, so without it the fallback install.ps1 gained for BG0575 is exercised by
           # nothing. The tag must fall back to the source archive, find no digest there, and
           # refuse under REQUIRE_CHECKSUM rather than invent verification.
-          $script:NoAsset = $true
-          function Invoke-WebRequest {
+                    function Invoke-WebRequest {
             param([string]$Uri, [string]$OutFile, [switch]$UseBasicParsing)
             $m = [System.Net.Http.HttpResponseMessage]::new([System.Net.HttpStatusCode]::NotFound)
             throw [Microsoft.PowerShell.Commands.HttpResponseException]::new('404 Not Found', $m)