v15.2.6 - Code review critical fixes (mutex, GPO regex, ScriptsPath, admin order)

v15.2.6 — Code review critical fixes

Production patch addressing security/reliability audit (H-01–H-14).

Critical fixes

ID	Fix
H-01	Install-Constants.ps1 mojibake header → ASCII
H-02	Log() mutex: track $acquired, always Dispose() — no handle leak
H-03	KS-Dnscrypt-EXE netsh rule uses "" quoting for paths with spaces
H-04	Legacy cleanup guarded with Test-Path $INSTALL_DIR
H-07	GPO scripts.ini regex: literal \[Startup\] (single-quoted patterns)
H-08	Generated scripts use Test-IsMainMonitor (matches Install-Helpers.ps1)
H-11	Admin check before any lib/ dot-source
H-12	Get-ShortCimSession validates stale session before reuse
H-14	$TUNNEL_SVC = 'WireGuardTunnel$' + $TUNNEL_NAME (safe interpolation)

Reliability

• ScriptsPath bug: Install-TasksAndWmi.ps1 used lib/scripts — fixed to repo root; audit scripts deployed to C:\WireGuard\scripts\
• post-reboot-verify: finds C:\WireGuard\scripts (no hardcoded user path)
• Watchdog: 3 min interval (matches STEP 12c / README)
• emergency-reset.bat: restored proper .bat wrapper + -Wait on UAC elevation + DHCP DNS restore

Tests

scripts/test-suite.ps1: 205 PASS