refactor(windows scripts): remove BOM and improve UTF-8 handling

windows/tools/harden.ps1

@@ -1,4 +1,4 @@
-<#
+<#
     LXS - Harden Windows
     Description: Apply a baseline security posture (firewall, SMBv1, UAC,
                  Defender, LLMNR/NetBIOS) and audit local accounts.
@@ -24,7 +24,10 @@ if ($LxsLibPath -and (Test-Path $LxsLibPath)) {
         Write-Error 'Failed to fetch lib/common.ps1'
         exit 1
     }
-    . ([scriptblock]::Create($LxsLibSource))
+    # The library ships with a UTF-8 BOM (Windows PowerShell 5.1 needs it to
+    # read the file as UTF-8); over HTTP that BOM arrives as a leading U+FEFF
+    # character, which the parser will not accept.
+    . ([scriptblock]::Create(($LxsLibSource -replace '^\uFEFF', '')))
 }
 
 $env:LXS_LOG_FILE = Join-Path (Get-LxsTempDir) 'lxs_harden.log'
@@ -266,7 +269,7 @@ if ($DoNameResolution) {
 }
 
 # ═══════════════════════════════════════════════════════════════════════════
-# Account audit — reports only, changes nothing.
+# Account audit - reports only, changes nothing.
 # ═══════════════════════════════════════════════════════════════════════════
 
 Write-Host ''
@@ -279,7 +282,7 @@ try {
     foreach ($a in $admins) { Write-Host "  - $($a.Name) $($script:Gray)($($a.ObjectClass), $($a.PrincipalSource))$($script:NC)" }
     if ($admins.Count -gt 2) {
         Write-Host ''
-        Write-LxsWarn "$($admins.Count) accounts have administrator rights — review whether they all need it."
+        Write-LxsWarn "$($admins.Count) accounts have administrator rights - review whether they all need it."
     }
 } catch {
     Write-LxsWarn "Could not enumerate the Administrators group: $($_.Exception.Message)"
@@ -301,7 +304,7 @@ try {
         Write-Host "$($script:Gray)  Password never expires: $($enabledNoExpiry.Name -join ', ')$($script:NC)"
     }
     if ($guest -and $guest.Enabled) {
-        Write-LxsWarn 'The Guest account is ENABLED — disable it unless you rely on it.'
+        Write-LxsWarn 'The Guest account is ENABLED - disable it unless you rely on it.'
     } else {
         Write-LxsOk 'Guest account is disabled'
     }
@@ -318,7 +321,7 @@ Show-LxsSeparator
 Write-Host ''
 Write-LxsOk "$changes hardening change(s) applied"
 if ($problems -gt 0) {
-    Write-LxsWarn "$problems change(s) failed — see the messages above."
+    Write-LxsWarn "$problems change(s) failed - see the messages above."
 }
 if ($DoSmb) {
     Write-LxsWarn 'Reboot to finish removing the SMBv1 client feature.'