Stop a non-elevated run from continuing past the admin guard

[BiosSystem]

Found while starting Track 3. Building integration tests meant running the entry script non-interactively, which is exactly the condition that exposes this.

The admin guard does not guard

Ensure-Admin.ps1 is dot-sourced, and exit inside a dot-sourced script does not terminate the caller. Every exit in that guard is inert. WinSwift prints "must be run as Administrator" and then carries on into the apply pipeline.

Reproduced non-elevated with stdin redirected — what any scripted or CI invocation looks like. Read-Host returns an empty string immediately, the prompt reads as declined, exit 1 does nothing:

WinSwift must be run as Administrator.
...
[WhatIf] Create registry backup
[WhatIf] Apply 15 registry changes from 'Disable_Telemetry.reg'
[WhatIf] Disable Scheduled Task: ...Microsoft Compatibility Appraiser
exit code 0

Under -DryRun nothing is written. Without it, an unprivileged process would attempt real registry imports and scheduled-task changes, fail partway on access denied, and leave a half-applied system — the precise state Track 1's rollback work exists to prevent.

The same defect breaks the relaunch path: after Start-Process -Verb RunAs succeeds, exit 0 does not stop the parent, so the elevated child and the original non-elevated process run WinSwift concurrently.

Mechanism, confirmed with a minimal repro

throw              exit=1  callerContinued=False  BLOCKED
no-cmdletbinding   exit=0  callerContinued=True   BYPASSED
exit-baseline      exit=0  callerContinued=True   BYPASSED

A dot-sourced script invoked with arguments cannot terminate its caller via exit, with or without [CmdletBinding()] — so [CmdletBinding()] is not the culprit. throw and caller-side handling both work.

Fix

The guard reports its outcome through $script:ElevationOutcome, which reaches the caller because dot-sourcing shares scope. WinSwift.ps1 exits on anything other than Elevated, before any runtime module loads:

• Relaunched → exit 0, the elevated child owns the run
• Denied / Failed → exit 1

Chose caller-side handling over throw so the relaunch case can exit 0 cleanly instead of surfacing an error for a successful handoff.

Also stops prompting when no console can answer — a redirected read returned instantly and was indistinguishable from a declined prompt, so that case now says why it cannot continue.

Verification

Same two probes that exposed the bug, after the fix:

Path	Before	After
-Verify (read-only)	exit 0, verification ran	exit 1, pipeline not reached
-DryRun (apply path)	exit 0, [WhatIf] output	exit 1, pipeline not reached

Tests added: source assertions for the outcome contract and its position ahead of module loading, plus a behavioral test that runs the entry script unelevated and asserts the pipeline is never reached. That one skips when already elevated, which is the case on CI runners — so CI proves the contract statically and the behavioral check runs for developers on a normal desktop.

Static validation passes (103 files); standalone rebuilt and parse-checked.