Add PowerShell lint job for packaging/windows scripts

Add windows-lint job to .github/workflows/ci.yml running
PSScriptAnalyzer against the three operator-facing PowerShell scripts
(build-zip.ps1, install-service.ps1, uninstall-service.ps1) on the
windows-latest runner. Job runs in parallel with build/test, no
needs:, no tag gating.

Also add packaging/windows/PSScriptAnalyzerSettings.psd1 with two
project-appropriate suppressions:

  PSAvoidUsingWriteHost — operator-facing progress in all three
    scripts is intentional; Write-Output would conflate progress
    with return value.
  PSAvoidUsingPositionalParameters — Copy-Item src dst / New-Item
    -Path style positional usage is widespread for cp/mv-like
    readability.

Severity = @('Error', 'Warning') gates CI on Warnings+ only,
skipping Information-only findings.

The lint job lives in ci.yml rather than package-windows.yml: keeps
the packaging workflow focused, avoids interleaving with the
structural-verification steps in package-windows.yml, and the lint
runs on every push (not just tags).

packaging/windows/PSScriptAnalyzerSettings.psd1

@@ -0,0 +1,25 @@
+# PSScriptAnalyzer settings for FIPS Windows packaging scripts.
+#
+# Starts from the default ruleset and excludes a small set of rules that
+# do not apply to operator-facing installer scripts. Each exclusion lists
+# why it was suppressed and which scripts justify it.
+
+@{
+    # Skip Information-level findings; gate CI on Warning and Error only.
+    Severity = @('Error', 'Warning')
+
+    ExcludeRules = @(
+        # Console output to the operator is intentional in build-zip.ps1,
+        # install-service.ps1, and uninstall-service.ps1. These scripts
+        # are run interactively by humans installing/packaging FIPS, and
+        # Write-Host gives them feedback at the terminal. Switching to
+        # Write-Output would conflate progress text with the (non-existent)
+        # script return value.
+        'PSAvoidUsingWriteHost',
+
+        # Copy-Item, New-Item, and similar cmdlet calls in the installer
+        # use positional parameters (source, destination) for readability
+        # and to mirror cp/mv conventions Unix-familiar operators expect.
+        'PSAvoidUsingPositionalParameters'
+    )
+}