fix: restrict startup unblock to PowerShell script files

Narrow the Mark-of-the-Web removal to .ps1/.psm1/.psd1: those are the only files the mark actually blocks (dot-sourcing), while other file types (json/xaml/reg/assets) are read through APIs that ignore the mark -- so their zone information is kept intact, and any future non-script payloads keep SmartScreen coverage. Addresses the CodeRabbit least-privilege note.

Author: HetCreep

Win11Debloat.ps1

@@ -114,12 +114,15 @@ if ($PSVersionTable.PSEdition -eq 'Core') {
     exit 1
 }
 
-# Remove the Mark-of-the-Web (Zone.Identifier) from all files in the script folder so the
-# dot-sourced scripts load without per-file security prompts. The stream is added when the
-# ZIP is downloaded with a browser and extracted with Explorer, and a Group-Policy-scoped
+# Remove the Mark-of-the-Web (Zone.Identifier) from the PowerShell script files so they
+# dot-source without per-file security prompts. The stream is added when the ZIP is
+# downloaded with a browser and extracted with Explorer, and a Group-Policy-scoped
 # execution policy overrides the -ExecutionPolicy Bypass that Run.bat passes, so launcher
-# flags alone cannot prevent the prompts. See issue #720.
-Get-ChildItem -Path $PSScriptRoot -Recurse -File | Unblock-File -ErrorAction SilentlyContinue
+# flags alone cannot prevent the prompts. Only script/module files are unblocked -- other
+# file types are not affected by the mark and keep their zone information. See issue #720.
+Get-ChildItem -Path $PSScriptRoot -Recurse -File |
+    Where-Object { $_.Extension -in '.ps1', '.psm1', '.psd1' } |
+    Unblock-File -ErrorAction SilentlyContinue
 
 # Check if script is running as administrator
 $isAdmin = ([Security.Principal.WindowsPrincipal] `