修复: swap-install 兼容无 Get-FileHash 的环境

- 本机 Windows PowerShell 5.1 实测缺 Get-FileHash(v3 脚本 3 处调用直接报错中断,换装不执行)
- 新增 Get-Sha256 辅助:优先 Get-FileHash,异常兜底系统 certutil;两法实测同值
- 收口 3 处调用(baseline/before/after)

scripts/swap-install.ps1

@@ -18,9 +18,19 @@ $builtExe  = 'E:\wk-lab\devflow\target\release\devflow.exe'
 $log       = 'E:\wk-lab\devflow\swap-install.log'
 $lockFile  = 'E:\wk-lab\devflow\swap-install.lock'
 
+# SHA256 取值:Get-FileHash 在部分环境的本机 Windows PowerShell 5.1 上不可用(实测 2026-10-10 缺失),
+# 兜底走系统自带的 certutil。返回大写十六进制串。
+function Get-Sha256($path) {
+    try { return (Get-FileHash -Path $path -Algorithm SHA256 -ErrorAction Stop).Hash }
+    catch { return (((certutil -hashfile $path SHA256) | Select-Object -Index 1) -replace '\s', '').ToUpper() }
+}
+
 # 构建产物哈希是唯一强基准; 产物缺失时退化为与安装前快照比对的弱校验
+# 实测(2026-10-10):装机 exe 与本基准哈希不一致(与 target/release/devflow.exe 同尺寸但字节不同,
+# 疑 NSIS 打包前打 bundle-type 补丁所致)→ 强基准恒不命中,实际退化为「两次安装字节一致 + 与
+# 安装前不同」的校验。该退化仍能拦住「installer exit=0 但 exe 未更新」(before==after)。
 $hashWant = $null
-if (Test-Path $builtExe) { $hashWant = (Get-FileHash $builtExe -Algorithm SHA256).Hash }
+if (Test-Path $builtExe) { $hashWant = Get-Sha256 $builtExe }
 
 # 0. SYSTEM 上下文转投用户会话
 $who = whoami
@@ -80,7 +90,7 @@ function Invoke-SwapInstall {
         "[$(Get-Date -Format 'HH:mm:ss')] FAIL: target missing after install" | Add-Content $log
         return $null
     }
-    $afterHash = (Get-FileHash $target -Algorithm SHA256).Hash
+    $afterHash = Get-Sha256 $target
     $afterSize = (Get-Item $target).Length
     "[$(Get-Date -Format 'HH:mm:ss')] installed size=$afterSize hash=$($afterHash.Substring(0, 12))" | Add-Content $log
     return $afterHash
@@ -110,7 +120,7 @@ try {
     # 3. 安装前快照, 供弱校验与前后比对
     $before = @{ hash = 'absent'; size = 0 }
     if (Test-Path $target) {
-        $before.hash = (Get-FileHash $target -Algorithm SHA256).Hash
+        $before.hash = Get-Sha256 $target
         $before.size = (Get-Item $target).Length
     }
     $beforeHashShort = $before.hash