fix(powershell): always use -EncodedCommand in Cmd()

[kke]

Fixes #398

Cmd() previously routed simple one-liners through the readable -Command "..." form and only base64-encoded when cmd.exe metacharacters were present. That guard set (" % ! ^ & | < >) omits every PowerShell metacharacter ($, backtick, ;, quotes, spaces), so the readable path is unsafe whenever the outer login shell is PowerShell -- e.g. OpenSSH with DefaultShell=PowerShell. There the outer shell parses and expands the argument (including the injected $ProgressPreference='SilentlyContinue'; prefix) before the inner powershell.exe runs, corrupting the command.

Cmd() is a pure string helper with no knowledge of the remote shell, so it cannot reliably decide when -Command is safe. Always emitting -EncodedCommand makes the payload opaque to both cmd.exe and PowerShell and correct regardless of the outer shell. The runner's debug log already decodes -EncodedCommand, so readability is preserved for logging.

[Copilot]

Pull request overview

This PR fixes an SSH/PowerShell interoperability bug by making powershell.Cmd() always emit -EncodedCommand, ensuring the PowerShell payload is not parsed/expanded by an outer PowerShell login shell (e.g., OpenSSH DefaultShell=PowerShell) before powershell.exe receives it.

Changes:

• Updated powershell.Cmd() to always return a powershell.exe ... -E <base64> command line (removing the conditional -Command "..." path).
• Revised unit tests to validate encoded output by decoding the -EncodedCommand payload and asserting on the decoded script contents.
• Updated golden tests to pin the new encoded command strings.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
powershell/powershell.go	Always uses -EncodedCommand and updates function documentation to explain why.
powershell/powershell_test.go	Updates tests to expect encoded output and adds helpers to decode and assert decoded script contents.
powershell/golden_test.go	Updates golden expectations to match the new encoded command strings.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.