Clean up CodeQL findings and AppVerifier release guard

[N0ahTM]

Summary

• Resolve six first-party CodeQL quality alerts: redundant bounds check, unused map iterator, and loop-counter mutations in CLI/UTF-16 processing.
• Replace the AppVerifier script's stale 0.9.1-only guard with a check against the latest local release tag, so published 0.9.2 and older packages cannot be used as destructive test targets.
• Preserve parser and UTF-16 behavior; no release or packaging changes.

Verification

• pwsh ./scripts/build-headless.ps1 -Platform x64 passed, including all CoreTests.
• PowerShell parser found no errors; local tags resolve the latest package version to 0.9.2.0.
• Markdown links and git diff --check passed; commit hook ran clang-format.
• CI is running; prior attempt failed when Chocolatey returned HTTP 504 while installing LLVM/Cppcheck, after build/tests had passed.

Code-scanning triage

Six other alerts were dismissed with explanations: two C++/WinRT coroutine false positives, one function that is called by a test fixture, and three generated C++/WinRT/XAML files. The remaining large-function warnings stay visible for focused refactoring in the next release.