ci(lint): update PSScriptAnalyzer settings and suppress warnings for plain-text passwords in templates

PSScriptAnalyzerSettings.psd1

@@ -9,7 +9,15 @@
         # (thousands of hits). Run locally with Invoke-ScriptAnalyzer -Fix to auto-format;
         # do not use as CI gate until the whole codebase has been reformatted.
         'PSUseConsistentIndentation',
-        'PSUseConsistentWhitespace'
+        'PSUseConsistentWhitespace',
+
+        # UTF-8 without BOM is the editor default; adding BOM to ~35 files is cosmetic
+        # and does not affect PS 5.1 execution.
+        'PSUseBOMForUnicodeEncodedFile',
+
+        # Plural nouns in internal helpers (Get-GuestDiagnostics, Remove-OldJobDirs, etc.)
+        # are intentional — they describe collections, not single objects.
+        'PSUseSingularNouns'
     )
 
     # ── Rule-specific configuration ──────────────────────────────────────────────