Specify authored PowerShell approval boundary

[Aaronontheweb]

Summary

• define CommandOccurrence completeness over authored executable syntax
• keep ambient profiles, modules, aliases, functions, PATH, and executable lookup outside approval analysis
• retain strict handling for explicit source mutation, computed or hidden execution, unsupported syntax, and policy-sensitive unknown facts
• keep default-mode loop-dependent effective values Unknown; isolated fresh no-profile mode proves ordinary literal loop values without a pinned module baseline
• preserve the existing public API shape

Validation

• adversarial review: PASS
• openspec validate --all --strict
• dotnet build -c Release --no-restore
• dotnet test -c Release --no-build: 2765 passed
• pwsh ./scripts/Add-FileHeaders.ps1 -Verify
• git diff --check