Harden NSIS host runtime command handling and SHA fallback

[svelderrainruiz]

Summary

• harden installer/runtime native command handling so git/gh stderr does not terminate execution under ErrorActionPreference=Stop
• add deterministic SHA256 helper with .NET fallback when Get-FileHash is unavailable in installer host contexts
• mirror governance script hardening into payload copy used by the NSIS installer

Why

Host NSIS validation through release-control-plane was failing due:

1. native command stderr being treated as terminating failures (From ..., No such remote 'upstream')
2. direct Get-FileHash dependency in installer runtime

This change keeps behavior deterministic while removing those false-negative failure modes.

Validation

• Invoke-Pester -Path ./tests -CI (240/240 passing)