Merge main into AL development guidance

Reconcile the read-only plan-enrichment contracts with main's folder-review
inputs and documentation structure. Record Windows alternate streams in
runner evidence and clear the regression harness exit status after expected
negative probes.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 638b66d2-9f06-4f60-8781-808709e1485c

tools/DevelopmentGuidance.Evidence.ps1

@@ -80,12 +80,24 @@ function Assert-GuidanceItem {
     if (($Item.Attributes -band [IO.FileAttributes]::ReparsePoint) -or $Item.LinkType -or $Item.LinkTarget) {
         throw 'Links, junctions, hard links and reparse points are not supported.'
     }
-    if (-not $Item.PSIsContainer -and $IsWindows) {
-        $streams = @(Get-Item -LiteralPath $Item.FullName -Stream '*' -Force -ErrorAction Stop)
-        if (@($streams | Where-Object Stream -ne ':$DATA').Count) {
-            throw 'Alternate data streams are not supported.'
-        }
-    }
+}
+
+function Get-GuidanceStreams {
+    param([string] $Path)
+    if (-not $IsWindows) { return @() }
+    return @(
+        Get-Item -LiteralPath $Path -Stream '*' -Force -ErrorAction Stop |
+            Where-Object Stream -ne ':$DATA' |
+            Sort-Object Stream -CaseSensitive |
+            ForEach-Object {
+                $streamPath = "$($_.FileName):$($_.Stream)"
+                [ordered]@{
+                    name = $_.Stream
+                    length = $_.Length
+                    sha256 = Get-GuidanceHash $streamPath
+                }
+            }
+    )
 }
 
 function Get-GuidanceSafePath {
@@ -198,6 +210,7 @@ function Get-GuidanceSnapshot {
                 $entry.length = $item.Length
                 $entry.lastWriteUtcTicks = $item.LastWriteTimeUtc.Ticks
                 $entry.sha256 = Get-GuidanceHash $item.FullName
+                $entry.streams = @(Get-GuidanceStreams $item.FullName)
             }
             $files.Add($entry)
         }

tools/Test-DevelopmentGuidanceEvaluator.ps1

@@ -419,3 +419,6 @@ try {
         Remove-Item -LiteralPath $scratch -Recurse -Force
     }
 }
+
+# Intentional negative native-command probes leave LASTEXITCODE nonzero.
+exit 0

tools/Test-DevelopmentGuidanceFixtures.ps1

@@ -20,10 +20,12 @@
     It cannot detect reverted transient writes, prove that articles were opened,
     or validate semantic faithfulness of prose. Files, directories, hashes,
     stable metadata, Git HEAD/refs/index and ignored/untracked files are compared.
-    Links/reparse points, hard links, alternate data streams, external Git
-    storage in targets, submodules and sparse checkouts are rejected rather than
-    followed. Run in quiescent repositories. The knowledge checkout may itself
-    be a linked Git worktree; its Git storage identity is recorded explicitly.
+    Links/reparse points, hard links, external Git storage in targets,
+    submodules and sparse checkouts are rejected rather than followed. Windows
+    alternate data streams are included in the evidence by name, length, and
+    hash; direct stream paths remain rejected. Run in quiescent repositories.
+    The knowledge checkout may itself be a linked Git worktree; its Git storage
+    identity is recorded explicitly.
 #>
 [CmdletBinding()]
 param(