fix(kiosk): Start-Process uses -FilePath, not -LiteralPath (app never launched)

3rd VM e2e: Shell Launcher now ENGAGES (kiosk shell up, no Explorer), but the
launcher's 'Start-Process -LiteralPath ...' errored — Start-Process has no
-LiteralPath parameter (that was an unvalidated review tweak; the proven form
is -FilePath). So the kiosk shell ran but the Welcome app never started. Revert
both the launcher and the RunOnce fallback to -FilePath. Single-quote escaping
of the path is unchanged.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

windows/installer/oem/Configure-Kiosk.ps1

@@ -22,7 +22,7 @@ $launcher='C:\Windows\Setup\Scripts\Start-WelcomeShell.cmd'
 $welcomeEscaped = $WelcomeExe.Replace("'","''")
 @"
 @echo off
-powershell -NoProfile -ExecutionPolicy Bypass -Command "Start-Process -LiteralPath '$welcomeEscaped' -Verb RunAs"
+powershell -NoProfile -ExecutionPolicy Bypass -Command "Start-Process -FilePath '$welcomeEscaped' -Verb RunAs"
 REM Shell Launcher tracks this CMD process; the Welcome app runs detached above.
 REM Loop keeps the process alive so Shell Launcher doesn't restart it on idle.
 :loop
@@ -59,7 +59,7 @@ catch {
     # Fail-OPEN: no kiosk, but the Welcome wizard must still launch (we removed FirstLogonCommands).
     $ro='HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce'
     New-Item $ro -Force | Out-Null
-    Set-ItemProperty $ro -Name 'SilverOSWelcome' -Type String -Value "cmd /c powershell -NoProfile -ExecutionPolicy Bypass -Command `"Start-Process -LiteralPath '$welcomeEscaped' -Verb RunAs`""
+    Set-ItemProperty $ro -Name 'SilverOSWelcome' -Type String -Value "cmd /c powershell -NoProfile -ExecutionPolicy Bypass -Command `"Start-Process -FilePath '$welcomeEscaped' -Verb RunAs`""
 }
 
 # --- Keyboard Filter (block shell hotkeys) ---