ci(lint): move PSScriptAnalyzer off the Linux runner (Phase C7)

Apply analysis §4 option 1: pssa job runs on windows-build with
shell: powershell, gated to workflow_dispatch so push/PR don't queue it when
no Windows runner is registered. The python job stays on linux-build. No job
on a Linux runner uses pwsh anymore.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/lint.yml

@@ -1,8 +1,13 @@
-# PSScriptAnalyzer + Python lint — runs on every push/PR that touches code files.
-# Requires PSScriptAnalyzer installed on the runner host:
-#   Install-Module PSScriptAnalyzer -Scope AllUsers -Force
+# Python lint runs on every push/PR (linux-build runner) and blocks the PR.
 #
-# Failures block the PR. Fix warnings with:
+# PSScriptAnalyzer (pssa) runs on the Windows runner (windows-build) on-demand
+# only — triggered via workflow_dispatch — because the .ps1/.psm1 targets are
+# Windows-native (PS 5.1). It is intentionally NOT queued on push/PR so it does
+# not block the pipeline when no Windows runner is registered (dual-boot Passo 9
+# may be down). This keeps the Linux host/runner free of pwsh (Phase C goal).
+# Requires PSScriptAnalyzer installed on the Windows runner host:
+#   Install-Module PSScriptAnalyzer -Scope AllUsers -Force
+# Fix warnings with:
 #   Invoke-ScriptAnalyzer -Path scripts\ -Recurse -Fix
 
 
@@ -27,7 +32,10 @@ on:
 
 jobs:
   pssa:
-    runs-on: linux-build
+    # On-demand only: runs on the Windows runner (PS 5.1), never on push/PR,
+    # so it cannot block the pipeline when no Windows runner is registered.
+    if: ${{ github.event_name == 'workflow_dispatch' }}
+    runs-on: windows-build
     timeout-minutes: 10
 
     steps:
@@ -37,7 +45,7 @@ jobs:
           fetch-depth: 1
 
       - name: Run PSScriptAnalyzer
-        shell: pwsh
+        shell: powershell
         run: |
           $ErrorActionPreference = 'Stop'