Improved error messages and exit codes in scripts/demo.ps1

[klssxx]

Context

scripts/demo.ps1 is the primary Quick Start entry point on Windows 11. It must fail clearly when prerequisites are missing and must never mask the real exit code from python -m thekey demo.

Requisito o riesgo al que responde

• Requisito: THEKEY_CONTRACT §1 (Original source is immutable — the demo must never touch the original; clear failure keeps newcomers from misreading state).
• Riesgo cubierto: THREAT-T1 (write outside the isolated workspace) and operator confusion — a silent non-zero exit hides whether the gate or the bootstrap failed.

Impacto si no se resuelve

A new Windows contributor sees exit 0 with a hidden failure, believes THEKEY passed, and reports a false "works" — undermining the reproducibility promise of the demo.

Acceptance criteria

• Every failure path (Python missing, pip install -e . fails, demo non-zero) writes an explicit, actionable message and returns that real exit code.
• A test or scripted scenario confirms the script propagates the demo's exit code (no forced 0).
• No call to Set-ExecutionPolicy; works without administrator.

Cómo se verifica

pwsh -NoProfile -File .\scripts\demo.ps1
echo $LASTEXITCODE
# expected (green run): 0 and demo prints RELEASE_ELIGIBLE, gates_passed: 4/4
# expected (missing python): non-zero and a clear "Python 3.11+ required" message

Evidencia en event store

On merge record Closes #2 + the script's own exit-code propagation test output in the PR body. The demo run it triggers must reach RELEASE_ELIGIBLE with evidence_mismatches: [].

Docs afectados

• README / README.en actualizado (if Quick Start text changes)
• CHANGELOG entrada añadida
• DECISIONS.md si hay decisión de diseño