Fix Windows inner signature PowerShell path (#7136)

Co-authored-by: Neil <neil@stably.ai>

config/scripts/verify-windows-inner-signature.mjs

@@ -7,7 +7,7 @@ export const DEFAULT_EXPECTED_SIGNER =
 
 const POWERSHELL_SIGNATURE_SCRIPT = String.raw`
 $ErrorActionPreference = 'Stop'
-$signature = Get-AuthenticodeSignature -FilePath $args[0]
+$signature = Get-AuthenticodeSignature -FilePath $env:ORCA_WINDOWS_INNER_EXECUTABLE
 $certificate = $signature.SignerCertificate
 [pscustomobject]@{
   status = $signature.Status.ToString()
@@ -130,6 +130,7 @@ export function validateExecutablePath(executablePath) {
 }
 
 export function getPowerShellSignatureJson(executablePath, spawnSyncImpl = spawnSync) {
+  // Why: pwsh -Command does not reliably expose trailing process args to string commands.
   const result = spawnSyncImpl(
     'pwsh',
     [
@@ -139,10 +140,15 @@ export function getPowerShellSignatureJson(executablePath, spawnSyncImpl = spawn
       '-ExecutionPolicy',
       'Bypass',
       '-Command',
-      POWERSHELL_SIGNATURE_SCRIPT,
-      executablePath
+      POWERSHELL_SIGNATURE_SCRIPT
     ],
-    { encoding: 'utf8' }
+    {
+      encoding: 'utf8',
+      env: {
+        ...process.env,
+        ORCA_WINDOWS_INNER_EXECUTABLE: executablePath
+      }
+    }
   )
 
   if (result.error) {

config/scripts/verify-windows-inner-signature.test.mjs

@@ -172,8 +172,15 @@ describe('verify-windows-inner-signature', () => {
     )
     expect(calls[0].command).toBe('pwsh')
     expect(calls[0].args).toContain('-Command')
-    expect(calls[0].args.at(-1)).toBe('C:\\Path With Spaces\\Orca.exe')
-    expect(calls[0].options).toEqual({ encoding: 'utf8' })
+    expect(calls[0].args.at(-1)).not.toBe('C:\\Path With Spaces\\Orca.exe')
+    expect(calls[0].options).toEqual(
+      expect.objectContaining({
+        encoding: 'utf8',
+        env: expect.objectContaining({
+          ORCA_WINDOWS_INNER_EXECUTABLE: 'C:\\Path With Spaces\\Orca.exe'
+        })
+      })
+    )
 
     expect(() =>
       getPowerShellSignatureJson('Orca.exe', () => ({ status: 0, stdout: '{}', stderr: 'warning' }))