Add PowerShell as an optional default shell

[BrettKinny]

Summary

Adds PowerShell 7 (pwsh) as a fourth option in setup's shell Selection, alongside the existing bash / zsh / fish.

What changes

• setup.sh — shell menu (gum + text) now offers powershell (experimental); new install_pwsh:
  • resolves the exact latest PowerShell/PowerShell GitHub release,
  • picks the architecture-matching .deb (amd64/arm64),
  • verifies GitHub's release-asset SHA-256 before download/install,
  • installs via apt_install so declared dependencies resolve under the existing sudo contract,
  • generates ~/.config/powershell/profile.ps1 mirroring the bashrc (starship / zoxide / mise activation; aliases as PowerShell functions since Set-Alias cannot attach arguments),
  • translates AI/editor/TUI selections into ~/.config/powershell/squarebox-selections.ps1 (mirrors the fish snippet flow).
• dotfiles/bashrc — ~/.squarebox-use-pwsh marker → exec pwsh -l handoff, with SQUAREBOX_NO_PWSH override; markers are now cleaned up mutually exclusively across all shells.
• scripts/squarebox-entrypoint.sh — a saved pwsh Selection reconciles when the binary or managed profile is missing from a Box (Box-tier lifecycle), matching zsh/fish.
• Docs/demo — README shell section, sqrbx-setup --help, CLAUDE.md contract, demo recorder, CHANGELOG.

Verification

• 19/19 host test files pass, including 12 new failure-injection cases:
  • metadata failure aborts before any download or Managed-home mutation,
  • digest mismatch rejects the asset,
  • verified install commits pwsh, activation marker is exclusive, profile sources the selection snippet, install goes through apt-get.
• Full e2e smoke suite: 62/62 pass against a fresh image build (podman build + scripts/e2e-test.sh smoke).
• The generated profile.ps1 was executed by real pwsh 7.6.5 (extracted from the official .deb): loads cleanly, sets EDITOR, defines c/lg/ls as functions, runs motd.

Notes

• PowerShell is labelled experimental, consistent with zsh/fish.
• Language/tooling integration points the repo already had: mise activate powershell and starship init powershell both emit valid PowerShell (verified), so profile activation uses them natively.