v15.3.2 - Server IP scope fix + emergency-reset upgrade hardening

v15.3.2 — Server IP Scope Fix + Install Hardening

Critical fix: monitor/repair empty SERVER_IP

Root cause: $serverIPs / $serverPort were set inside Invoke-InstallMainSteps0to6 (function scope) but Invoke-InstallGeneratedScripts read script-scope variables — monitor was generated with empty server IPs and KS-WARP-Server-Out was never created.

Fix:

• Install-MainSteps-0-6.ps1: persist to $script:serverIPs / $script:serverPort
• Install-GeneratedScripts.ps1: read script scope with WARP fallback
• Install-TasksAndWmi.ps1: registry ServerIP from $script:serverIPs

Install hardening

• Install-MainSteps-18-20.ps1: clear +S +H attributes before overwriting emergency-reset.ps1/.bat (fixes "Access denied" on upgrade)
• safe-live-verify.ps1: GPO version regex accepts v15.3.x

Unchanged (v15.3.1)

• AI Connection Invariant: pre-flight quiesce + DryRun preview-only

Test gate

1045+ assertions (version bump in constants/install header).