chore(ci): lint with PSScriptAnalyzer before the Pester suite

PSScriptAnalyzer is the PowerShell linter, and there is no typecheck for
PowerShell, so it is the whole of that half. Errors fail the job; warnings
are printed and do not - the repo was written without the analyzer, and a
gate that goes red on day one over style becomes a gate someone disables.
PSAvoidUsingWriteHost is excluded outright: these are command-line tools
whose Write-Host output is the interface.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

.github/workflows/tests.yml

@@ -1,7 +1,7 @@
 # The Pester suite, on every push to main and every PR.
 #
 # This repo is one of the twelve on the fleet board
-# (evomedia.net/testsuites.html) and was one of four with no CI at all, so the
+# (evomedia.net/testsuites.html) and was one of three with no CI at all, so the
 # only thing ever running these tests was a workstation at 04:00. That is a
 # poor place for the only copy of a check to live.
 #
@@ -36,17 +36,41 @@ jobs:
       # the repository.
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
-      # Pinned to 5.x: the suite is written against the v5 configuration API
-      # (New-PesterConfiguration), and Windows images still carry a v3 in the
-      # module path that would be picked ahead of it.
-      - name: Install Pester 5
+      # Pester pinned to 5.x: the suite is written against the v5 configuration
+      # API (New-PesterConfiguration), and Windows images still carry a v3 in
+      # the module path that would be picked ahead of it. PSScriptAnalyzer is
+      # the PowerShell linter; there is no typecheck for PowerShell, so the
+      # analyzer is the whole of that half.
+      - name: Install Pester 5 and PSScriptAnalyzer
         shell: powershell
         run: |
           Set-PSRepository -Name PSGallery -InstallationPolicy Trusted
           Install-Module Pester -MinimumVersion 5.5.0 -MaximumVersion 5.99.99 `
             -Force -SkipPublisherCheck -Scope CurrentUser
+          Install-Module PSScriptAnalyzer -Force -Scope CurrentUser
           Import-Module Pester -MinimumVersion 5.5.0
-          (Get-Module Pester).Version.ToString()
+          'Pester ' + (Get-Module Pester).Version + ', PSScriptAnalyzer ' + (Get-Module -ListAvailable PSScriptAnalyzer | Select-Object -First 1).Version
+
+      # Errors fail the job; warnings are printed and do not. The repo was
+      # written without the analyzer, and turning every style warning into a
+      # red build on day one would make the gate something to disable rather
+      # than something to keep. PSAvoidUsingWriteHost is excluded outright:
+      # these are command-line tools whose Write-Host output IS the interface.
+      - name: Lint (PSScriptAnalyzer)
+        shell: powershell
+        run: |
+          $r = Invoke-ScriptAnalyzer -Path . -Recurse -ExcludeRule PSAvoidUsingWriteHost
+          $warn = @($r | Where-Object Severity -eq Warning)
+          $err  = @($r | Where-Object Severity -eq Error)
+          if ($warn) {
+            Write-Host ("{0} warning(s), not failing the build:" -f $warn.Count)
+            $warn | Format-Table RuleName, ScriptName, Line -AutoSize | Out-String | Write-Host
+          }
+          if ($err) {
+            $err | Format-Table RuleName, ScriptName, Line, Message -AutoSize -Wrap | Out-String | Write-Host
+            throw ("PSScriptAnalyzer: {0} error(s)" -f $err.Count)
+          }
+          Write-Host "no errors"
 
       # -CI sets the exit code from the result, which is the whole point here:
       # Invoke-Pester on its own reports failures and still exits 0, so the