[LM-325] PowerShell user attribution; blocks reference ENDOR_ATTR_USE…

[Mahesh-Kete]

What

Adds user attribution to the Windows / PowerShell Package Firewall MDM scripts —
the follow-up to #7 (bash). Every package-manager request is stamped
<console-user>@<machine> so the firewall log's User column traces to a person,
without per-user API keys.

Stacked on #7 (base branch = LM-325_Adding_user_attribution_for_bash_files);
merge #7 first.

How it works (mirrors the bash design)

• Credentials are computed at install time in templates/envvars.ps1: the
  attributed username (Get-EndorAttrUsername, byte-identical output to bash's
  endor_attr_username — verified) plus derived auth values are written to
  HKCU:\Environment, where every new process inherits them.
• Env-expanding tools (npm, yarn berry, maven, poetry) read ${ENDOR_ATTR_USER} /
  secret from HKCU. Literal tools (pip, uv, go) get attributed URLs baked into
  pip.ini / uv.toml / go env at install time.
• With Windows now supplying ENDOR_ATTR_USER, the shared blocks reference the
  attributed variable directly (npmrc.txt, yarnrc.txt, mavensettings.txt) —
  the bash-side install-time swap shims from [LM-325] Add user attribution (<console-user>@<machine>) to bash Pack… #7 are deleted on both platforms.

Hardening ported from #7

• Credential charset guard at generation; both URL userinfo halves percent-encoded.
• pip [global] merge in Invoke-UpsertBlock (duplicate-section fix), incl. :
  delimiters, INI continuation lines, CRLF tolerance, content-derived key list;
  Invoke-RemoveBlock restores #endor-bak#-disabled keys.
• Warning footer → exit 1 (MDM alert hook) wired through Test-KeyConflict.
• endor-remove.ps1 also removes ENDOR_ATTR_USER, legacy ENDOR_PYPI_URL/
  ENDOR_GO_PROXY_URL, and yarn-copied registry lines.

Windows-specific fixes

• UTF-8 BOM: all config writes go through Write-EndorFile (BOM-less). Windows
  PowerShell 5.1's -Encoding UTF8 writes a BOM that makes pip silently ignore
  pip.ini (empirically confirmed in earlier testing).
• Windows uv bug: uv.toml previously shipped with a raw {{ENDOR_PYPI_URL}}
  token (never substituted by generate.ps1 on main); now filled at install time.
• Deleted dead code: powershell/templates/blocks/ (4 stale duplicates of
  shared/blocks) and the unused Set-ProfileEnvBlock/Remove-ProfileEnvBlock
  helpers (relics of the abandoned $PROFILE approach).

Testing

• Windows E2E on staging (fresh machine state): npm, pip, uv, poetry, go, maven —
  allowed installs route through the firewall, malware test packages are Blocked,
  and every log row shows User = shrey@pkg-firewall-wi (previously N/A on Windows).
  pip config list parses pip.ini cleanly (BOM fix confirmed on-box).
• Cross-platform parity: bash and PowerShell produce byte-identical attributed
  usernames for the same label + key.
• 48 automated checks on pwsh 7.4 (21 unit tests on the merge/remove logic —
  same case matrix as the bash suite — plus 27 generation tests: syntax parse of all
  six outputs, unresolved-token audit, hostile-secret rejection, fills/footer/remove
  content verification).
• yarn classic / pnpm / bun not installed on the Windows test box — verified on
  macOS in [LM-325] Add user attribution (<console-user>@<machine>) to bash Pack… #7; the Windows mechanism they depend on (HKCU expansion in .npmrc)
  is covered by the npm run.