fix(ci): isolate racing signing analyzer rules

The Windows signing gate intermittently crashes inside PSScriptAnalyzer
1.25.0 while its rules share lazy PowerShell command metadata. This
blocks the standards 1.1.0 release and MarkdownViewr's production
signing rollout. The unchanged gate reproduced the
`CommandInfo.get_Parameters` failure locally on the fourth cold process;
the first two-pass candidate also failed in
`CommandInfo.ResolveParameter`.

Run `PSUseCorrectCasing` and `PSReservedCmdletChar` separately, followed
by every remaining configured rule. The latter shares
`Helper.GetExportedFunction` with the comment-help rule, so separating
casing alone is insufficient for this exported signing module. All three
original source files, pinned analyzer/Pester versions, settings, fatal
findings/exceptions, 35 signing tests and ten-minute job timeout are
retained. No rules or checks are disabled and no retry conceals
failures.

Three negative fixtures require detection of incorrect command casing, a
reserved character in an exported cmdlet name, and `Write-Host`. These
validate each pass before analyzing the real signing files. Full
exception details remain visible if the analyzer fails again.

Validation:

- Exact workflow analyzer body passed 20 predetermined cold PowerShell
processes, each covering all three files and all three negative
fixtures. Original race reproduced; the rejected two-pass candidate's
failure is retained.
- All 35 signing/Velopack tests passed with zero skips.
- `actionlint`, actual authenticated online `zizmor --min-severity
medium`, and `git diff --check` passed; existing suppressions unchanged.
- Hosted checks pending at creation. Maintainer review of this exact
change is required before merge under K22-AI-01; earlier review of the
signing implementation/reference correction is not reused for this new
behavior.

Related: PowerShell/PSScriptAnalyzer#1708,
KofTwentyTwo/MarkdownViewr.Windows#5, and #40. Substantial AI
assistance: Codex (GPT-6).

Signed-off-by: James Maes <james@kof22.com>
Co-authored-by: Codex (GPT-6) <noreply@openai.com>

.github/workflows/ci.yml

@@ -131,9 +131,31 @@ jobs:
           Install-Module Pester -RequiredVersion 5.7.1 -Scope CurrentUser -Force
           Import-Module PSScriptAnalyzer -RequiredVersion 1.25.0
           Import-Module Pester -RequiredVersion 5.7.1
+          # Keep every configured rule; isolate concurrent command-metadata consumers.
+          # https://github.com/PowerShell/PSScriptAnalyzer/issues/1708
+          $settings = 'configs/shell/PSScriptAnalyzerSettings.psd1'
+          $casingFixture = @(Invoke-ScriptAnalyzer -ScriptDefinition "get-content -literalpath 'fixture.txt'" -Settings $settings -IncludeRule PSUseCorrectCasing)
+          if ('PSUseCorrectCasing' -notin $casingFixture.RuleName) { throw 'The casing pass did not detect incorrect casing.' }
+          $reservedFixture = @(Invoke-ScriptAnalyzer -ScriptDefinition 'function Get-Fixture? { [CmdletBinding()] param() }; Export-ModuleMember -Function Get-Fixture?' -Settings $settings -IncludeRule PSReservedCmdletChar)
+          if ('PSReservedCmdletChar' -notin $reservedFixture.RuleName) { throw 'The reserved-character pass did not detect the exported function.' }
+          $remainingFixture = @(Invoke-ScriptAnalyzer -ScriptDefinition "Write-Host 'fixture'" -Settings $settings -ExcludeRule PSUseCorrectCasing, PSReservedCmdletChar)
+          if ('PSAvoidUsingWriteHost' -notin $remainingFixture.RuleName) { throw 'The remaining-rule pass did not detect Write-Host.' }
           foreach ($path in @('tools/WindowsSigning.psm1', 'tools/WindowsSigning.Tests.ps1', 'tools/VelopackSigning.Tests.ps1'))
           {
-             $findings = @(Invoke-ScriptAnalyzer -Path $path -Settings configs/shell/PSScriptAnalyzerSettings.psd1)
+             Write-Output "Analyzing $path"
+             try
+             {
+                $findings = @(
+                   Invoke-ScriptAnalyzer -Path $path -Settings $settings -IncludeRule PSUseCorrectCasing
+                   Invoke-ScriptAnalyzer -Path $path -Settings $settings -IncludeRule PSReservedCmdletChar
+                   Invoke-ScriptAnalyzer -Path $path -Settings $settings -ExcludeRule PSUseCorrectCasing, PSReservedCmdletChar
+                )
+             }
+             catch
+             {
+                Write-Output $_.Exception.ToString()
+                throw
+             }
              if ($findings.Count -gt 0) { $findings | Format-Table; throw "Script analysis failed: $path" }
           }
           $configuration = New-PesterConfiguration