ci(lint): update PSScriptAnalyzer settings and suppress warnings for plain-text passwords in templates

PSScriptAnalyzerSettings.psd1

@@ -9,7 +9,15 @@
         # (thousands of hits). Run locally with Invoke-ScriptAnalyzer -Fix to auto-format;
         # do not use as CI gate until the whole codebase has been reformatted.
         'PSUseConsistentIndentation',
-        'PSUseConsistentWhitespace'
+        'PSUseConsistentWhitespace',
+
+        # UTF-8 without BOM is the editor default; adding BOM to ~35 files is cosmetic
+        # and does not affect PS 5.1 execution.
+        'PSUseBOMForUnicodeEncodedFile',
+
+        # Plural nouns in internal helpers (Get-GuestDiagnostics, Remove-OldJobDirs, etc.)
+        # are intentional — they describe collections, not single objects.
+        'PSUseSingularNouns'
     )
 
     # ── Rule-specific configuration ──────────────────────────────────────────────

template/Install-CIToolchain-WinBuild2022.ps1

@@ -123,6 +123,8 @@
       Set-ExecutionPolicy Bypass -Scope Process -Force
       .\Install-CIToolchain-WinBuild2022.ps1 -BuildPassword 'YourPassword'
 #>
+[Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSAvoidUsingConvertToSecureStringWithPlainText', '',
+    Justification = 'Template setup script: plain-text password from CI credential store converted to SecureString for local user creation. Intentional by design.')]
 [CmdletBinding()]
 param(
     # Local username for the CI build account inside the VM

template/Install-CIToolchain-WinBuild2025.ps1

@@ -123,6 +123,8 @@
       Set-ExecutionPolicy Bypass -Scope Process -Force
       .\Install-CIToolchain-WinBuild2025.ps1 -BuildPassword 'YourPassword'
 #>
+[Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSAvoidUsingConvertToSecureStringWithPlainText', '',
+    Justification = 'Template setup script: plain-text password from CI credential store converted to SecureString for local user creation. Intentional by design.')]
 [CmdletBinding()]
 param(
     # Local username for the CI build account inside the VM

template/Prepare-WinBuild2022.ps1

@@ -113,6 +113,8 @@
         -VMXPath 'F:\CI\Templates\WinBuild\WinBuild.vmx' -VMIPAddress 192.168.79.130 `
         -BuildPassword 'StrongCIPass!2026' -StoreCredential
 #>
+[Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSAvoidUsingConvertToSecureStringWithPlainText', '',
+    Justification = 'Template setup script: plain-text password from CI credential store converted to SecureString for WinRM PSCredential. Intentional by design.')]
 [CmdletBinding()]
 param(
     # Path to the VM .vmx — enables auto power-on + IP detection + auto snapshot.

template/Prepare-WinBuild2025.ps1

@@ -113,6 +113,8 @@
         -VMXPath 'F:\CI\Templates\WinBuild\WinBuild.vmx' -VMIPAddress 192.168.79.130 `
         -BuildPassword 'StrongCIPass!2026' -StoreCredential
 #>
+[Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSAvoidUsingConvertToSecureStringWithPlainText', '',
+    Justification = 'Template setup script: plain-text password from CI credential store converted to SecureString for WinRM PSCredential. Intentional by design.')]
 [CmdletBinding()]
 param(
     # Path to the VM .vmx — enables auto power-on + IP detection + auto snapshot.

template/Validate-DeployState.ps1

@@ -41,6 +41,8 @@
     # Linux
     .\Validate-DeployState.ps1 -VMIPAddress 192.168.79.200 -GuestOS Linux
 #>
+[Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSAvoidUsingConvertToSecureStringWithPlainText', '',
+    Justification = 'Template validation script: plain-text password converted to SecureString for WinRM PSCredential. Intentional by design.')]
 [CmdletBinding()]
 param(
     [Parameter(Mandatory)] [string] $VMIPAddress,