fix: harden kata boundaries and validation

[krotname]

Summary

• fix confirmed overflow, validation, determinism, and complexity defects across kata helpers
• make transaction order invalidation fail closed and return immutable status collections
• replace unbounded encryption/range loops with bounded algorithms and preserve whitespace/case deterministically
• make generated smoke coverage fail when every executable path fails, with focused regressions
• add a strict PowerShell offline gate plus a Windows CI job that primes and validates the exact dependency set
• update bilingual documentation and the verified test baseline

Validation

• ./scripts/run-offline-gate.ps1 -Goal verify (offline; cached JUnit 6.1.0 fallback because the exact 6.1.1 BOM is not present locally)
• 594 tests, 0 failures/errors/skips
• JaCoCo: 91.39% line, 86.71% branch, 93.83% instruction
• Checkstyle: 0 violations
• PMD: 0 violations
• SpotBugs: 0 findings/errors
• PowerShell AST, XML, YAML, whitespace, and staged secret-pattern checks passed

[sonarqubecloud]

Quality Gate failed

Failed conditions
D Reliability Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

💡 Need a hand with PR review? Try Gitar by Sonar!