fix: make updater checksum verification self-contained

tests/update-service.test.mjs

@@ -410,6 +410,29 @@ test("binary helper confirms startup through the production Node spawn options",
   }
   await rm(temp, { recursive: true, force: true, maxRetries: 5, retryDelay: 50 });
 });
+
+test("binary helper verifies SHA-256 without PowerShell module autoloading", { skip: process.platform !== "win32" }, async () => {
+  const temp = await mkdtemp(path.join(os.tmpdir(), "forgeflow-binary-dotnet-sha-"));
+  const binaryPath = path.join(temp, "update.exe");
+  const currentPath = path.join(temp, "current.exe");
+  const statusPath = path.join(temp, "status.json");
+  const logPath = path.join(temp, "helper.log");
+  const bytes = Buffer.from("verified update bytes");
+  await writeFile(binaryPath, bytes);
+  await writeFile(currentPath, "current");
+  const expectedSha256 = createHash("sha256").update(bytes).digest("hex");
+  const powershell = path.join(process.env.SystemRoot || process.env.WINDIR, "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
+  const scriptPath = fileURLToPath(new URL("../scripts/apply-binary-update.ps1", import.meta.url));
+  const { stderr } = await execFileAsync(powershell, [
+    "-NoLogo", "-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass", "-File", scriptPath,
+    "-BinaryPath", binaryPath, "-ExpectedSha256", expectedSha256, "-ExpectedVersion", "9.9.9",
+    "-CurrentExecutable", currentPath, "-Portable", "False", "-ParentPid", String(process.pid),
+    "-LogPath", logPath, "-StatusPath", statusPath, "-UpdateId", "dotnet-sha", "-VerifyOnly",
+  ], { windowsHide: true, env: { ...process.env, PSModulePath: "" } });
+  assert.equal(stderr, "");
+  assert.match(await readFile(logPath, "utf8"), /Verification-only SHA-256 check completed successfully/);
+  await rm(temp, { recursive: true, force: true, maxRetries: 5, retryDelay: 50 });
+});
 test("early helper exit reports the helper log instead of only an exit code", async () => {
   const temp = await mkdtemp(
     path.join(os.tmpdir(), "forgeflow-update-log-tail-"),
@@ -626,7 +649,7 @@ test("binary update helper verifies, waits, applies and records restart state",
     "utf8",
   );
   for (const marker of [
-    "Get-FileHash",
+    "Security.Cryptography.SHA256",
     "Wait-Process",
     'Write-UpdateState -State "started"',
     'Write-UpdateState -State "waiting-for-exit"',
@@ -640,4 +663,5 @@ test("binary update helper verifies, waits, applies and records restart state",
       `missing binary updater marker: ${marker}`,
     );
   }
+  assert.doesNotMatch(helper, /Get-FileHash/);
 });