chore(scripts): cover PowerShell's Env: drive, and correct two stale scope summaries (#2146)

Copilot, eleventh review:

- `Set-Item Env:SMOKE_BROWSER firefox` — PowerShell's Env: DRIVE, the other
  standard way to write the environment there — matched none of the patterns.
  Covered now, positional or via -Path/-Value, for Set-Item/New-Item and their
  -ItemProperty forms. A `Get-Item` READ is still not a finding, which has its
  own negative case: reading the variable is not setting it, the same
  distinction as round 5's `echo "SMOKE_BROWSER: firefox"`.

- Two scope summaries had drifted behind the traversal, both saying the guard
  reads only `run` and `env`/`with`: the module header's "ONLY EXECUTABLE
  POSITIONS" paragraph, and the copilot-instructions mirror. Both list the real
  set now — `run`, the `shell` command template at all three levels, and
  `env`/`container.env`/`with`. The mirror one is the AGENTS.md rule this repo
  states about itself, so it is a rule violation rather than a typo.

Signed-off-by: Cliff Hall <cliff@futurescale.com>
Signed-off-by: cliffhall <cliff@futurescale.com>

scripts/lib/workflow-gate.test.mjs

@@ -348,6 +348,36 @@ describe("findWorkflowViolations", () => {
       text: workflow("      - shell: pwsh\n        run: npm run smoke"),
       rules: [],
     },
+    {
+      // Copilot, eleventh review: PowerShell's Env: drive is the other standard
+      // way to write the environment there.
+      name: "flags a Set-Item write to the Env: drive",
+      text: workflow(
+        "      - run: Set-Item Env:SMOKE_BROWSER firefox; npm run smoke",
+      ),
+      rules: [VIOLATION.BROWSER_ENV],
+    },
+    {
+      name: "flags the named -Path/-Value spelling too",
+      text: workflow(
+        '      - run: New-Item -Path Env:SMOKE_BROWSER -Value "firefox"',
+      ),
+      rules: [VIOLATION.BROWSER_ENV],
+    },
+    {
+      name: "allows a Set-Item write pinning chromium",
+      text: workflow(
+        '      - run: Set-Item -Path Env:SMOKE_BROWSER -Value "chromium"',
+      ),
+      rules: [],
+    },
+    {
+      // Reading the variable is not setting it — the same distinction as
+      // `echo "SMOKE_BROWSER: firefox"` from round 5.
+      name: "does not flag a Get-Item read of the same variable",
+      text: workflow("      - run: Get-Item Env:SMOKE_BROWSER; npm run smoke"),
+      rules: [],
+    },
     {
       // Copilot, tenth review: GitHub's multiline environment-file syntax.
       // Reported as unreadable rather than parsed — see the comment on the