Harden WinSCP download/unzip with error handling and diagnostics

Expand-Archive was failing with a cryptic "End of Central Directory record
could not be found" on Melissa's PC - the inline one-liner in setup.bat had
no error handling, so a blocked/truncated download (antivirus, firewall, or
an older TLS default) surfaced as a raw .NET exception instead of a useful
message. Moved the logic to Get-WinSCP.ps1: forces TLS 1.2, validates the
downloaded file size before unzipping, and reports what actually went wrong.

Get-WinSCP.ps1

@@ -0,0 +1,41 @@
+# Downloads and unpacks the WinSCP automation package engine.ps1 needs.
+# Called by setup.bat. Safe to re-run.
+
+[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
+
+$url  = "https://winscp.net/download/WinSCP-6.3.6-Automation.zip"
+$zip  = Join-Path $env:TEMP "winscp.zip"
+$dest = Join-Path $PSScriptRoot "WinSCP"
+
+if (Test-Path $zip) { Remove-Item $zip -Force }
+
+Write-Host "Downloading WinSCP from $url ..."
+try {
+    Invoke-WebRequest -Uri $url -OutFile $zip -UseBasicParsing
+} catch {
+    Write-Host "ERROR: Download failed - $($_.Exception.Message)" -ForegroundColor Red
+    Write-Host "Check your internet connection, or ask IT if winscp.net / sourceforge.net are blocked." -ForegroundColor Yellow
+    exit 1
+}
+
+$fileInfo = Get-Item $zip
+if ($fileInfo.Length -lt 1MB) {
+    Write-Host "ERROR: Downloaded file is only $($fileInfo.Length) bytes - too small to be WinSCP." -ForegroundColor Red
+    Write-Host "This usually means antivirus or a firewall blocked/altered the download instead of letting the real file through." -ForegroundColor Yellow
+    Write-Host "Try running setup.bat again. If it keeps happening, download WinSCP-6.3.6-Automation.zip manually from winscp.net and unzip it into:" -ForegroundColor Yellow
+    Write-Host "  $dest" -ForegroundColor Yellow
+    Remove-Item $zip -Force
+    exit 1
+}
+
+try {
+    Expand-Archive -Path $zip -DestinationPath $dest -Force
+} catch {
+    Write-Host "ERROR: Could not unzip the download - $($_.Exception.Message)" -ForegroundColor Red
+    Write-Host "The downloaded file was likely corrupted or cut short in transit. Try running setup.bat again." -ForegroundColor Yellow
+    Write-Host "Left the bad file at $zip in case you want to look at it." -ForegroundColor Yellow
+    exit 1
+}
+
+Remove-Item $zip -Force
+Write-Host "WinSCP ready." -ForegroundColor Green

setup.bat

@@ -1,5 +1,3 @@
 @echo off
-echo Downloading WinSCP...
-powershell.exe -ExecutionPolicy Bypass -Command ^
-  "$url = 'https://winscp.net/download/WinSCP-6.3.6-Automation.zip'; $zip = '%TEMP%\winscp.zip'; $dest = '%~dp0WinSCP'; Invoke-WebRequest -Uri $url -OutFile $zip; Expand-Archive -Path $zip -DestinationPath $dest -Force; Write-Host 'WinSCP ready.' -ForegroundColor Green"
+powershell.exe -ExecutionPolicy Bypass -File "%~dp0Get-WinSCP.ps1"
 pause