docs(tests): document branding test suite + elevation requirement

ci(branding): run branding Pester suite before Build packed ISO step

.gitea/workflows/build-iso-windows.yaml

@@ -108,6 +108,16 @@ jobs:
           }
           "path=$dst" >> $env:GITHUB_OUTPUT
 
+      - name: Test branding module (Pester)
+        shell: pwsh
+        run: |
+          Set-PSRepository PSGallery -InstallationPolicy Trusted -ErrorAction SilentlyContinue
+          if (-not (Get-Module -ListAvailable Pester | Where-Object Version -ge '5.0.0')) {
+            Install-Module Pester -MinimumVersion 5.0 -Scope CurrentUser -Force -SkipPublisherCheck
+          }
+          $r = Invoke-Pester windows/tests/Branding.Tests.ps1 -PassThru -Output Detailed
+          if ($r.FailedCount -gt 0) { throw "$($r.FailedCount) branding test(s) failed" }
+
       - name: Build packed ISO
         shell: pwsh
         run: |

windows/tests/README.md

@@ -12,3 +12,9 @@ Verification gates for a SilverMetal Enhanced — Windows build
 
 The telemetry-leak test is the honesty gate: it documents the minimum-feasible
 Microsoft contact that remains, per design-principle #2.
+
+## Branding.Tests.ps1
+
+Pester v5 unit + offline-integration tests for `windows/branding/`.
+**Requires an elevated shell** (the offline-integration test uses `reg load`).
+Run: `pwsh -NoProfile -Command "Invoke-Pester windows/tests/Branding.Tests.ps1"`.