chore(scripts): cover PowerShell's Env: drive, and correct two stale scope summaries (#2146)

Copilot, eleventh review:

- `Set-Item Env:SMOKE_BROWSER firefox` — PowerShell's Env: DRIVE, the other
  standard way to write the environment there — matched none of the patterns.
  Covered now, positional or via -Path/-Value, for Set-Item/New-Item and their
  -ItemProperty forms. A `Get-Item` READ is still not a finding, which has its
  own negative case: reading the variable is not setting it, the same
  distinction as round 5's `echo "SMOKE_BROWSER: firefox"`.

- Two scope summaries had drifted behind the traversal, both saying the guard
  reads only `run` and `env`/`with`: the module header's "ONLY EXECUTABLE
  POSITIONS" paragraph, and the copilot-instructions mirror. Both list the real
  set now — `run`, the `shell` command template at all three levels, and
  `env`/`container.env`/`with`. The mirror one is the AGENTS.md rule this repo
  states about itself, so it is a rule violation rather than a typo.

Signed-off-by: Cliff Hall <cliff@futurescale.com>
Signed-off-by: cliffhall <cliff@futurescale.com>

scripts/lib/workflow-gate.mjs

@@ -55,9 +55,10 @@
  * Those belong in CI and are there today — `smoke:tui` self-skips under
  * `process.env.CI` on its own, so it needs no guarding.
  *
- * ONLY EXECUTABLE POSITIONS ARE SCANNED — `run:` scalars (inline and block),
- * and the values of an `env:` or `with:` mapping, found by parsing the file
- * rather than by matching lines. Everything else in a workflow is metadata that
+ * ONLY EXECUTABLE POSITIONS ARE SCANNED, found by parsing the file rather than
+ * by matching lines: `run:` scalars (inline and block), a custom `shell:`
+ * command template (step-level, and `defaults.run.shell` at workflow and job
+ * level), and the values of an `env:`, `container.env:` or `with:` mapping. Everything else in a workflow is metadata that
  * runs nothing, so scanning it produces findings that are simply false:
  * `name: Explain why smoke:web:firefox stays local` executes nothing, and
  * failing the suite on it would contradict the "what it forbids, and nothing
@@ -67,8 +68,8 @@
  * the wrong thing.
  *
  * That is a real limit, stated rather than hidden: an execution vector outside
- * those three positions — a custom action that reads a script name from
- * somewhere else, say — is not seen. The alternative, scanning everything, was
+ * those positions — a custom action that reads a script name from somewhere
+ * else, say — is not seen. The alternative, scanning everything, was
  * measured against this repo's own workflow and produces false positives on
  * ordinary step names, which is the faster way to get a guard deleted.
  */
@@ -184,6 +185,16 @@ const BROWSER_ASSIGNMENTS = [
     ),
     value: 1,
   },
+  // PowerShell's Env: DRIVE, the other standard way to write the environment
+  // there: `Set-Item Env:SMOKE_BROWSER firefox`, or with `-Path`/`-Value`
+  // (Copilot). The value may be positional or named.
+  {
+    re: new RegExp(
+      String.raw`\b(?:Set|New)-Item(?:Property)?\b[^\n]*?\bEnv:${BROWSER_ENV_VAR}\b\s*(?:-Value\s+)?${ASSIGNED_VALUE}`,
+      "gi",
+    ),
+    value: 1,
+  },
   // GitHub's MULTILINE environment-file syntax: `SMOKE_BROWSER<<EOF`, the value
   // on following lines, then the delimiter. Reported as unreadable rather than
   // parsed (Copilot): the value can arrive through any number of shapes — a

scripts/lib/workflow-gate.test.mjs

@@ -348,6 +348,36 @@ describe("findWorkflowViolations", () => {
       text: workflow("      - shell: pwsh\n        run: npm run smoke"),
       rules: [],
     },
+    {
+      // Copilot, eleventh review: PowerShell's Env: drive is the other standard
+      // way to write the environment there.
+      name: "flags a Set-Item write to the Env: drive",
+      text: workflow(
+        "      - run: Set-Item Env:SMOKE_BROWSER firefox; npm run smoke",
+      ),
+      rules: [VIOLATION.BROWSER_ENV],
+    },
+    {
+      name: "flags the named -Path/-Value spelling too",
+      text: workflow(
+        '      - run: New-Item -Path Env:SMOKE_BROWSER -Value "firefox"',
+      ),
+      rules: [VIOLATION.BROWSER_ENV],
+    },
+    {
+      name: "allows a Set-Item write pinning chromium",
+      text: workflow(
+        '      - run: Set-Item -Path Env:SMOKE_BROWSER -Value "chromium"',
+      ),
+      rules: [],
+    },
+    {
+      // Reading the variable is not setting it — the same distinction as
+      // `echo "SMOKE_BROWSER: firefox"` from round 5.
+      name: "does not flag a Get-Item read of the same variable",
+      text: workflow("      - run: Get-Item Env:SMOKE_BROWSER; npm run smoke"),
+      rules: [],
+    },
     {
       // Copilot, tenth review: GitHub's multiline environment-file syntax.
       // Reported as unreadable rather than parsed — see the comment on the