Unblock WinSCP folder every run and fail loudly if Add-Type still can't load it

The Get-WinSCP.ps1 unblock-on-extract fix wasn't enough - if the WinSCP
folder is ever copied again afterward (network share, zip, sync tool),
Windows can reapply Mark-of-the-Web and silently re-block it. Unblock the
whole folder at the top of every engine.ps1 run instead of relying on
setup.bat timing. Also wrapped Add-Type in try/catch so a real load failure
now stops the run with a clear message instead of silently continuing into
a script that would only fail later once it actually tried to upload
something.

engine.ps1

@@ -51,7 +51,21 @@ if (-not (Test-Path $winscpDll)) {
     Write-Log "error" "WinSCP DLL not found at $winscpDll"
     exit 1
 }
+
+# Unblock every run, regardless of how the WinSCP folder got here - Windows
+# tags files as untrusted ("Mark of the Web") if they were ever downloaded or
+# copied from a network share/zip, which blocks Add-Type from loading them.
+Get-ChildItem -Path (Join-Path $scriptRoot "WinSCP") -Recurse -File |
+    Unblock-File -ErrorAction SilentlyContinue
+
+try {
     Add-Type -Path $winscpDll
+} catch {
+    Write-Host "ERROR: Could not load WinSCPnet.dll - $($_.Exception.Message)" -ForegroundColor Red
+    Write-Host "Try deleting the WinSCP\ folder and running setup.bat again." -ForegroundColor Yellow
+    Write-Log "error" "Add-Type failed for $winscpDll : $($_.Exception.Message)"
+    exit 1
+}
 
 # -- Entity config -------------------------------------------------------------
 $entityConfigFile = Join-Path $EntityDir "entity.json"