feat(status-line): surface hidden native non-zero exits as LastExit: N tag

PowerShell treats pipeline success as "$? on the last statement",
not "all natives exited 0". A pipeline like `cmd /c exit 7; "after"`
ends with $? True (the "after" string succeeded) even though cmd
returned 7. PowerShell.MCP previously rendered this as:

  ✓ Pipeline executed successfully | ... | Duration: 0.20s | Location ...

— the 7 was completely silent. An AI driving a CI-style pipeline
(`npm install; npm audit; npm test` and so on) would read the ✓,
assume clean, and move on while npm audit's non-zero exit carried
real information that just got dropped.

Port the gating pattern ripple uses for its OSC 633;L extension:

  1. Snapshot $global:LASTEXITCODE BEFORE Invoke-Expression runs, so
     we can later tell whether THIS pipeline wrote the value or
     inherited it from an earlier native invocation in a prior call.

  2. Capture $? and $global:LASTEXITCODE IMMEDIATELY after
     Invoke-Expression returns — any statement between (including a
     bare variable assignment) would reset $? to True.

  3. Report only when all three gates fire:
        $?        True  (pipeline overall succeeded → ✓ badge)
        lecChanged     (native wrote $LASTEXITCODE this pipeline)
        lec non-zero   (the value worth telling the AI about)
     Any other combination is silent: failed pipelines already show
     ✗ + Errors count, and a stale $LASTEXITCODE from a prior
     session would only add noise to current happy-path lines.

The new `LastExit: N` segment sits immediately after Duration in the
status line — next to the exit-code semantic domain, ahead of
Errors/Warnings/Info which describe PS streams (a separate axis).

Examples:

  cmd /c exit 7; "after"
    Before: ✓ ... | Duration: 0.20s | Location ...
    After:  ✓ ... | Duration: 0.20s | LastExit: 7 | Location ...

  Get-Item /nope                     → ✗ ... | Errors: 1 | ...
    (lecChanged false, $? false, LastExit gates all silent)

  "plain string"                     → ✓ ... | Duration: 0.20s | ...
    (no native ran, LastExit silent)

Session-state limitation inherited from ripple's implementation:
if the prior pipeline happened to leave $LASTEXITCODE at the same
value this pipeline's native produces (e.g. `cmd /c exit 7` twice
in a row), lecChanged is false and LastExit stays silent. The
underlying PS constraint (no runtime hook for "a native updated
LASTEXITCODE") makes a fully deterministic detection impossible.
Documented in docs/pwsh-mcp-vs-ripple-evaluation.md.

No API or wire-shape change. The `LastExitReport` field is only
added to the in-process StreamResults hashtable; existing callers
tolerate its presence, and the status-line rendering omits the tag
when the value is 0 (matches the zero-tag-omission discipline used
for Errors/Warnings/Info).

Author: yotsuda

PowerShell.MCP/Resources/MCPPollingEngine.ps1

@@ -102,13 +102,29 @@ if (-not (Test-Path Variable:global:McpTimer)) {
                 $warningVar = @()
                 $informationVar = @()
 
+                # Snapshot $LASTEXITCODE BEFORE the pipeline so we can
+                # tell whether this invocation TOUCHED it (a native exe
+                # ran and updated the variable) vs inherited a stale
+                # value from an earlier native in a prior call. Without
+                # this snapshot, reporting $LASTEXITCODE verbatim would
+                # leak a stale 7 from `cmd /c exit 7` into every
+                # subsequent pure-PowerShell pipeline.
+                $lecAtStart = $global:LASTEXITCODE
+
                 try {
                     $redirectedOutput = Invoke-Expression $Command `
                         -OutVariable outVar `
                         -ErrorVariable errorVar `
                         -WarningVariable warningVar `
                         -InformationVariable informationVar
 
+                    # Capture post-pipeline state IMMEDIATELY. Any
+                    # statement below (even a bare variable assignment)
+                    # resets $? to True, so grab the two signals we
+                    # care about before the dedup loop runs.
+                    $ok = $?
+                    $lec = $global:LASTEXITCODE
+
                     # Deduplicate errors (PowerShell ErrorVariable can record the same error multiple times)
                     $uniqueErrors = @()
                     $seenErrors = @{}
@@ -126,12 +142,31 @@ if (-not (Test-Path Variable:global:McpTimer)) {
                         }
                     }
 
+                    # LastExitReport gating: only surface a non-zero
+                    # native exit when the pipeline OVERALL SUCCEEDED
+                    # ($? True) AND $LASTEXITCODE was actually written
+                    # by this pipeline (not stale from before) AND the
+                    # written value is non-zero. When $? is False the
+                    # status icon flips to ✗ and errorCount is already
+                    # surfacing the failure, so LastExit would be
+                    # redundant. Zero means "silent — no native
+                    # reported, or the last one returned 0". Mirrors
+                    # ripple's OSC 633;L contract so the two MCPs
+                    # surface the same semantic across shells.
+                    $lecChanged = $lec -ne $lecAtStart
+                    $lastExitReport = if ($ok -and $lecChanged -and $null -ne $lec -and $lec -ne 0) {
+                        [int]$lec
+                    } else {
+                        0
+                    }
+
                     return @{
                         Success = $outVar
                         Error = $uniqueErrors
                         Exception = @()
                         Warning = $warningVar
                         Information = $informationVar
+                        LastExitReport = $lastExitReport
                     }
                 }
                 catch {
@@ -143,6 +178,13 @@ if (-not (Test-Path Variable:global:McpTimer)) {
                         Exception = $exceptionVar
                         Warning = $warningVar
                         Information = $informationVar
+                        # Pipeline threw — the exception itself is the
+                        # primary failure signal. Don't also surface
+                        # LastExit: a native that set $LASTEXITCODE
+                        # before the throw is of lower interest than
+                        # the thrown exception and would just add
+                        # noise to the error-path response.
+                        LastExitReport = 0
                     }
                 }
             }
@@ -318,6 +360,16 @@ if (-not (Test-Path Variable:global:McpTimer)) {
                 $warningCount = $outputStreams.Warning.Count
                 $infoCount = $outputStreams.Information.Count
                 $hasErrors = $errorCount -gt 0
+                # LastExitReport is 0 when the invocation did not
+                # surface a hidden native exit (see
+                # Invoke-CommandWithAllStreams for the gating). Null-
+                # safe read — the older wire shape without this field
+                # still drains to 0 silently.
+                $lastExitReport = if ($StreamResults.ContainsKey('LastExitReport')) {
+                    [int]$StreamResults.LastExitReport
+                } else {
+                    0
+                }
 
                 # Truncate pipeline for status line
                 # Split by newline, pipe character, and limit to 30 chars
@@ -358,10 +410,17 @@ if (-not (Test-Path Variable:global:McpTimer)) {
                 # by construction. This follows the same "omit what
                 # equals zero" discipline the status line already uses
                 # for `$pipelineInfo`.
-                $errInfo  = if ($errorCount   -gt 0) { " | Errors: $errorCount" }    else { "" }
-                $warnInfo = if ($warningCount -gt 0) { " | Warnings: $warningCount" } else { "" }
-                $infoInfo = if ($infoCount    -gt 0) { " | Info: $infoCount" }       else { "" }
-                $statusLine = "$statusIcon Pipeline $statusText | Window: $windowTitle | Status: $Status$pipelineInfo | Duration: $durationText$errInfo$warnInfo$infoInfo | $LocationInfo"
+                $errInfo     = if ($errorCount     -gt 0) { " | Errors: $errorCount" }       else { "" }
+                $warnInfo    = if ($warningCount   -gt 0) { " | Warnings: $warningCount" }   else { "" }
+                $infoInfo    = if ($infoCount      -gt 0) { " | Info: $infoCount" }          else { "" }
+                # `LastExit: N` surfaces a native exe that returned
+                # non-zero mid-pipeline when the pipeline overall
+                # succeeded — the ✓ badge would otherwise silently
+                # hide the non-zero exit. Positioned right after
+                # Duration so it sits next to the exit-code domain
+                # (Errors is about PS $Error stream, a separate axis).
+                $lastExitInfo = if ($lastExitReport -gt 0) { " | LastExit: $lastExitReport" } else { "" }
+                $statusLine = "$statusIcon Pipeline $statusText | Window: $windowTitle | Status: $Status$pipelineInfo | Duration: $durationText$lastExitInfo$errInfo$warnInfo$infoInfo | $LocationInfo"
 
                 # Generate structured output strings
                 $structuredOutput = @{