fix(installer): '✔ System tools' prints even when k3d.exe cannot execute — gate on a real tool run

[LukasWodka]

Why

On a test machine (RTX 4050 laptop), the installed k3d.exe was broken — The specified executable is not a valid application for this OS platform — yet Step 1 still concluded ✔ System tools, because the only post-install execution is a Log "k3d: $(k3d version ...)" interpolation whose failure is non-terminating. The install then reached Step 2 and failed there (see companion spinner issue). kubectl/helm have the same gap.

Where

scripts/install-k8s.ps1 (v1.9.6): L737 (k3d), L658 (kubectl Log), L771 (helm Log).

Scope

• After each tool install, execute it (k3d version, kubectl version --client, helm version --short) as a hard gate; non-zero/exception → remove the binary and Err with a remedy (expected vs actual arch via Get-WindowsArch, re-download hint).
• Investigate how an invalid binary passed install: winget path vs direct path (direct has checksum verify; winget shims/partial installs don't) — add the execute-gate regardless of path.

Acceptance criteria

• A corrupt or wrong-arch k3d.exe fails Step 1 loudly with an actionable message; Step 2 is never reached.
• Pester coverage for the execute-gate failure path.

[LukasWodka]

Cross-OS audit result: this is an all-three-OSes bug, not a Windows one (bash v1.9.6 evidence):

• Linux: the only post-install "verification" is log-only and failure-masking — scripts/lib/setup-linux.sh L405 kubectl version --client --short 2>/dev/null || echo present, L450/L487 (k3d, log-only), L649 helm version --short 2>/dev/null || echo installed.
• macOS: same masking at scripts/lib/setup-macos.sh L259/L264/L269 — and brew delivers the binaries with no checksum at all (acquisition change tracked in fix(installer): macOS installs tools via bare brew — version pins inoperative, no checksums, no execute-gate #429).

Suggested widened AC: after installing each tool on every OS, actually execute it (k3d version, kubectl version --client, helm version --short) as a hard gate — non-zero → remove binary + fail with remedy. Cover in bats + Pester and the bash↔ps1 drift check.

[shujaatTracebloc]

Fix merged to develop in #451. Closing manually — auto-close only fires on merge to the default branch.