fix(setup): inspect signer through native provider

scripts/windows_signer_preflight.ps1

@@ -17,6 +17,19 @@ $stdoutPath = "$receiptBase.out"
 $stderrPath = "$receiptBase.err"
 $process = $null
 
+function Get-NativeWindowsPowerShellPath() {
+    # Inno Setup is a 32-bit launcher even when the installation itself is in
+    # 64-bit mode.  A relative powershell.exe can therefore inspect the pinned
+    # certificate through the 32-bit key-provider view and incorrectly report
+    # that its private key is unavailable.  Always run the read-only inspection
+    # through native Windows PowerShell, matching the transactional backend.
+    if ([Environment]::Is64BitOperatingSystem -and -not [Environment]::Is64BitProcess) {
+        $sysnative = Join-Path $env:SystemRoot "Sysnative\WindowsPowerShell\v1.0\powershell.exe"
+        if (Test-Path -LiteralPath $sysnative -PathType Leaf) { return $sysnative }
+    }
+    return (Join-Path $env:SystemRoot "System32\WindowsPowerShell\v1.0\powershell.exe")
+}
+
 function Stop-PreflightProcess([System.Diagnostics.Process]$Target) {
     if ($null -eq $Target -or $Target.HasExited) { return }
     $killer = Start-Process -FilePath "$env:SystemRoot\System32\taskkill.exe" `
@@ -36,7 +49,7 @@ try {
         "-Action Inspect",
         "-CertificateSha256 $CertificateSha256"
     ) -join " "
-    $process = Start-Process -FilePath powershell.exe -ArgumentList $argumentLine `
+    $process = Start-Process -FilePath (Get-NativeWindowsPowerShellPath) -ArgumentList $argumentLine `
         -RedirectStandardOutput $stdoutPath -RedirectStandardError $stderrPath `
         -WindowStyle Hidden -PassThru
     if (-not $process.WaitForExit($TimeoutSeconds * 1000)) {

tests/test_build_profiles.py

@@ -153,6 +153,9 @@ def test_windows_setup_wizard_is_native_offline_and_fail_closed():
     )
     assert 'ValidatePattern(\'^[0-9a-fA-F]{64}$\')' in preflight
     assert '"-Action Inspect"' in preflight
+    assert '"Sysnative\\WindowsPowerShell\\v1.0\\powershell.exe"' in preflight
+    assert '"System32\\WindowsPowerShell\\v1.0\\powershell.exe"' in preflight
+    assert "Start-Process -FilePath (Get-NativeWindowsPowerShellPath)" in preflight
     assert ".WaitForExit($TimeoutSeconds * 1000)" in preflight
     assert "$process.Refresh()" in preflight
     assert "if ($null -eq $process.ExitCode) { exit 1 }" in preflight