Fix cross-platform backups and refresh policy validation

[devin-ai-integration]

Summary

• Make Get-PolicyValue return a consistent snapshot shape on Linux and macOS so strict-mode backup creation no longer fails on the missing ReadError property before policy writes.
• Exercise the normal Linux apply-with-backup path in behavioral validation.
• Refresh the official Brave policy template evidence to 150.1.94.57, keep updater output UTF-8 without BOM, and pin the remaining checkout steps to the reviewed v5.0.1 commit.

Link to Devin session: https://app.devin.ai/sessions/c1632e2d7a214e65950180394f66fb9a
Requested by: @osfv

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[greptile-apps]

Greptile Summary

This PR fixes a strict-mode crash on Linux and macOS where Get-PolicyValue returned objects without a ReadError property, causing Get-PolicySnapshot to throw when accessing $value.ReadError under Set-StrictMode -Version Latest. It also fixes Update-PolicyTemplateVersion.ps1 from emitting UTF-8 BOM on Windows PowerShell 5.1 by replacing Set-Content -Encoding UTF8 with an explicit System.Text.UTF8Encoding($false) write.

• src/PlatformPolicy.ps1: All four non-Registry return paths in Get-PolicyValue now include ReadError = $false, making the shape consistent with the Registry branch and preventing strict-mode property-access errors during backup creation on Linux/macOS.
• scripts/Update-PolicyTemplateVersion.ps1: A new Set-Utf8NoBomText helper replaces Set-Content -Encoding UTF8 so the policy manifest and validation doc are written without a BOM, and a matching BOM regression test is added to Test-PolicyManifest.ps1.
• config/policies.json + docs/debloatable-validation.md: Policy template version bumped to 150.1.94.57; CI actions/checkout pinned to a reviewed commit SHA (v5.0.1).

Confidence Score: 5/5

Safe to merge. The changes are narrowly scoped: a one-property addition to four return sites in Get-PolicyValue, a BOM-free writer replacing Set-Content, updated tests, and a version bump.

All changed code paths in PlatformPolicy.ps1 correctly add ReadError = $false to match the Registry branch shape, eliminating the strict-mode property-access failure during Linux/macOS backup creation. The Set-Utf8NoBomText function is straightforward, and its Resolve-Path call is always satisfied because both target files are read before being written. The new tests directly exercise both the backup path and the BOM-free output, giving good regression coverage.

No files require special attention. The most behaviorally significant change is in src/PlatformPolicy.ps1, and its correctness is directly confirmed by the updated Test-Behavior.ps1 Linux backup assertions.

Important Files Changed

Filename	Overview
src/PlatformPolicy.ps1	Adds ReadError = $false to all four non-Registry return paths in Get-PolicyValue, fixing a strict-mode crash when Get-PolicySnapshot accesses $value.ReadError on Linux/macOS objects that previously lacked the property.
scripts/Update-PolicyTemplateVersion.ps1	Adds Set-Utf8NoBomText helper that writes via System.IO.File::WriteAllText with UTF8Encoding($false), replacing Set-Content -Encoding UTF8 which emits a BOM on Windows PowerShell 5.1; Resolve-Path is called before WriteAllText, which requires the target file to already exist, but both call sites satisfy that constraint.
scripts/Test-PolicyManifest.ps1	Adds a BOM regression check after the version-updater run; reads the first three bytes of both output files and throws if the UTF-8 BOM sequence (0xEF 0xBB 0xBF) is present.
scripts/Test-Behavior.ps1	Linux apply test now exercises the backup path (removes -NoBackup, passes -BackupDirectory) and asserts both 'Backup written' in output and exactly one BraveDebloater-*.json in the backup directory.
.github/workflows/ci.yml	Pins actions/checkout from the mutable @v5 tag to a reviewed commit SHA (93cb6efe) for both jobs, with a human-readable # v5.0.1 comment for traceability.
config/policies.json	Routine policy template version bump from 150.1.94.4 to 150.1.94.57; no structural changes to the manifest.
docs/debloatable-validation.md	Updates template version references and archive timestamp to match the new 150.1.94.57 evidence; trailing blank line removed.

Sequence Diagram

%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
    participant Script as Invoke-BraveDebloat.ps1
    participant PP as PlatformPolicy.ps1
    participant FS as File System

    Script->>PP: "Get-PolicyTarget(Platform=Linux)"
    PP-->>Script: "Target{Kind=JsonFile, Path=...}"

    Note over Script,PP: applyChanges=true, NoBackup=false
    Script->>PP: New-Backup → Get-PolicySnapshot
    loop each policy name
        PP->>PP: Get-PolicyValue(Target, PolicyName)
        Note over PP: Before fix: no ReadError property → strict-mode crash<br/>After fix: ReadError = $false on all non-Registry branches
        PP-->>PP: "{Exists, Value, Kind, ReadError=$false}"
    end
    PP->>FS: "Write BraveDebloater-*.json backup"
    FS-->>PP: backup path
    PP-->>Script: backup path
    Script->>FS: Log Backup written to ...
    Script->>PP: Set-PolicyValue (writes JsonFile policy)
    PP->>FS: Write BraveDebloater.json policy

    Note over Script,FS: Update-PolicyTemplateVersion.ps1 path
    Script->>FS: Get-Content -Raw (reads file, PS5.1 strips BOM)
    Script->>Script: Regex replace policyTemplateVersion
    Script->>FS: Set-Utf8NoBomText → WriteAllText(UTF8NoBom)

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
    participant Script as Invoke-BraveDebloat.ps1
    participant PP as PlatformPolicy.ps1
    participant FS as File System

    Script->>PP: "Get-PolicyTarget(Platform=Linux)"
    PP-->>Script: "Target{Kind=JsonFile, Path=...}"

    Note over Script,PP: applyChanges=true, NoBackup=false
    Script->>PP: New-Backup → Get-PolicySnapshot
    loop each policy name
        PP->>PP: Get-PolicyValue(Target, PolicyName)
        Note over PP: Before fix: no ReadError property → strict-mode crash<br/>After fix: ReadError = $false on all non-Registry branches
        PP-->>PP: "{Exists, Value, Kind, ReadError=$false}"
    end
    PP->>FS: "Write BraveDebloater-*.json backup"
    FS-->>PP: backup path
    PP-->>Script: backup path
    Script->>FS: Log Backup written to ...
    Script->>PP: Set-PolicyValue (writes JsonFile policy)
    PP->>FS: Write BraveDebloater.json policy

    Note over Script,FS: Update-PolicyTemplateVersion.ps1 path
    Script->>FS: Get-Content -Raw (reads file, PS5.1 strips BOM)
    Script->>Script: Regex replace policyTemplateVersion
    Script->>FS: Set-Utf8NoBomText → WriteAllText(UTF8NoBom)

Loading

_{Reviews (1): Last reviewed commit: "Fix cross-platform backups and refresh v..." | Re-trigger Greptile}