ci: the Windows refusal test failed because the refusal succeeded

GitHub's PowerShell step wrapper appends 'exit $LASTEXITCODE', so the
inner preflight's deliberate exit 1 — the exact outcome the step had just
asserted — leaked out as the step's own failure. Clear it with an explicit
exit 0 once the refusal is verified. The 5.1 log from the failing run shows
the ps1 behaving perfectly: STATUS=refuse, correctly composed em dash,
'unsupported host Windows' reason.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -245,6 +245,10 @@ jobs:
           $joined = $out -join "`n"
           if ($joined -notlike "*STATUS=refuse*") { throw "no STATUS=refuse in output" }
           if ($joined -notlike "*unsupported host 'Windows'*") { throw "missing refusal reason" }
+          Write-Output "native refusal verified (5.1)"
+          # the runner appends `exit $LASTEXITCODE`; the refusal's exit 1 is
+          # the EXPECTED outcome we just asserted, so clear it explicitly
+          exit 0
       - name: ps1 refuses natively (pwsh)
         shell: pwsh
         run: |
@@ -252,6 +256,8 @@ jobs:
           $out | Write-Output
           if ($LASTEXITCODE -eq 0) { throw "preflight did not refuse under pwsh" }
           if (($out -join "`n") -notlike "*STATUS=refuse*") { throw "no STATUS=refuse in output" }
+          Write-Output "native refusal verified (pwsh)"
+          exit 0   # clear the asserted refusal's exit 1 (runner appends exit $LASTEXITCODE)
       - name: sh entry point also refuses here (Git Bash)
         shell: bash
         run: |