refactor: extract IPowerShellRunner seam for DNS/network/winget services

[laurentiu021]

What

Audit Round 4 / PR2 — Gate-ARCH seam extraction (covers test findings #7, #8, #9). Introduces IPowerShellRunner over the concrete PowerShellRunner:

• New IPowerShellRunner exposing RunAsync, RunScriptViaPwshAsync, RunProcessAsync, and the LineReceived/ProgressChanged events.
• PowerShellRunner : IPowerShellRunner (members unchanged).
• DnsService, NetworkRepairService, BulkInstallerService constructors now take IPowerShellRunner.
• DI registers IPowerShellRunner -> PowerShellRunner (Transient) alongside the existing concrete registration, kept for the remaining consumers that still resolve the concrete type.

Why

These three services mutate live state (DNS servers, Winsock/TCP-IP, winget install) but depend on the concrete sealed PowerShellRunner, so NSubstitute can't substitute them — every test was forced to new XxxService(new PowerShellRunner()) and avoid the Apply paths entirely. This seam is the precondition for the install/repair/DNS-script unit tests in the next PR.

Behavior guarantee (Protocol Q)

Behavior is byte-for-byte identical — only the dependency type the three services accept changes. No logic touched. The static PowerShellRunner.OemEncoding stays on the concrete class and is still referenced as PowerShellRunner.OemEncoding everywhere.

Verification

• Build: main + unit tests + integration tests, 0 errors / 0 warnings (Release).
• Gate-ARCH: interface surface matches the concrete public instance members exactly (5/5).
• Propagate check: the 5 sites that new these services (MainWindowViewModel + 2 test helpers) still compile unchanged (PowerShellRunner IS IPowerShellRunner). No half-migration.

Notes

• refactor: — no version bump, no release, no CHANGELOG entry required.