[Phase 1a] Umbrella: In-process stateless prompt-retry implementation

[usepowershell]

Part of #98

Tracks all in-process implementation steps for Option A+D.

Child Issues

• [Phase 1a] Design and implement snapshot encoding (HMAC-SHA256) #99 Snapshot encoding (HMAC-SHA256)
• [Phase 1a] Implement custom PSHost for prompt interception #100 Custom PSHost prompt interception
• [Phase 1a] Implement prompt matching and retry logic #101 Prompt matching and retry logic
• [Phase 1a] Update PowerShellAssemblyGenerator for Option A validation #102 Option A pre-execution validation
• [Phase 1a] Extend MCP schema with promptBehavior metadata #103 MCP schema promptBehavior metadata
• [Phase 1a] Integration tests for Read-Host, Get-Credential, and device code #104 Integration tests for prompt scenarios
• [Phase 1a] Security review spike for snapshot integrity and TTL #105 Security review spike