feat(windows): apply current-user personalization

[DevSecNinja]

Summary

• add an idempotent run_onchange script for current-user Windows personalization
• configure dark mode, taskbar/File Explorer preferences, Spotlight, Dutch regional settings, and the requested US-International language list
• restore US number separators after culture configuration
• preserve the migrated audit trail in a single executable 14-setting catalog with descriptions, rationales, citations, evidence grades, and reversal guidance
• document each preference and evidence distinction in docs/customization.md, including community-grade registry mappings that are not official policy contracts
• cover desired state, metadata completeness, ordering, idempotency, WhatIf, and non-admin scope with Pester

Validation

• Focused personalization Pester: 9 passed
• Broad PowerShell Pester excluding the environment-dependent signing file: 775 passed, 3 skipped
• Full PowerShell Pester: 801 passed, 4 failed, 4 skipped; all four failures are in Sign-PowerShellScripts.Tests.ps1 because this host reports UnknownError for its untrusted test certificate while the tests accept only Valid
• PSScriptAnalyzer: clean for the runtime script
• Windows PowerShell 5.1 and PowerShell 7 parsers: clean
• chezmoi apply --dry-run --source=.: passed
• Lefthook pre-commit on all files: passed

Environment notes

• mise install / mise exec cannot complete because the unrelated apm-cli package hits a PyPI TLS handshake failure; validation used the exact already-installed mise-pinned binaries.
• The Bash validation runner timed out while attempting to install Bats through password-protected sudo; no Bash files changed.