skill: cross-OS preflight — ps1 entry point, one CI-enforced contract

On a Windows host the preflight's job is to deliver a structured refusal
(measurement is Linux/POSIX-only). But a Windows-native harness with no
POSIX shell never got that far: preflight.sh fails to LAUNCH, and an agent
staring at "sh: not found" is exactly the agent that hand-rolls a timing
loop. The refusal doctrine has to be as portable as the skill.

- scripts/preflight.ps1: faithful port of the preflight contract, runs on
  Windows PowerShell 5.1 and pwsh 7+ on any OS. Host check first (so
  Windows refuses before touching anything), same walk-up resolution, same
  always-build rule, same key=value output, same exit codes. The source is
  pure ASCII with the shared em dashes composed at runtime — Windows
  PowerShell 5.1 misdecodes BOM-less UTF-8, and that exact bug class
  already bit this machine once (the francis-watchdog parse failure).
- Two implementations of one contract is a drift risk, so it is gated like
  every other claim in this repo: the skill-preflight CI job now runs BOTH
  scripts on the same ubuntu host and byte-diffs their stdout on all three
  paths (in-checkout resolve, no-checkout refusal, PELTIER_HOME from a
  foreign repo). Disagreement is a red build, not a footnote.
- New skill-preflight-windows job (windows-latest): asserts the native
  refusal end-to-end under Windows PowerShell 5.1 AND pwsh (STATUS=refuse,
  nonzero exit, the 'unsupported host' reason), plus Git Bash sh for good
  measure. Verified live on a real Windows 11 box before shipping: 5.1
  parses the pure-ASCII source clean and refuses with exit 1.
- SKILL.md / references/verify.md: document the second entry point ("use
  whichever your host can launch; never both, never neither"); book chapter
  and CLAUDE.md updated to match. .agents mirror regenerated (identical).
  The ZeroClaw variant is unaffected: rm -rf scripts/ drops the ps1 too,
  and its audit still passes (7 files scanned).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/src/skill.md

@@ -83,7 +83,13 @@ document. In `verify` mode, the gate order is the content:
 
 Measurement requires a Linux/POSIX host — the same requirement as the rest of
 the pipeline. On Windows (or with no checkout reachable) the skill refuses and
-says why. That is asserted, not assumed: on every pull request, CI runs the
+says why. The refusal itself is cross-OS: preflight ships as both `preflight.sh`
+(POSIX) and `preflight.ps1` (Windows PowerShell 5.1 / pwsh), so a Windows-native
+harness with no POSIX shell still gets a structured `STATUS=refuse` instead of a
+launch error it might misread as license to hand-roll a timing loop. Two
+implementations of one contract is a drift risk, so CI byte-diffs their output
+on every path (resolve, refuse, `PELTIER_HOME`) on the same host, and a Windows
+runner asserts the native refusal on every pull request. That is asserted, not assumed: on every pull request, CI runs the
 preflight's refusal path (skill copied outside any checkout) and its resolve
 paths (in-checkout and via `PELTIER_HOME` from a foreign repo), alongside a
 live plumbing run of the harness it drives.