docs(security): Install-PSModules.ps1 help marks two live callers as (planned)

`scripts/security/Install-PSModules.ps1` marks two of its three callers as `(planned)` in the comment-based help, but both already call it.

Lines 49-50 of the `.NOTES` block read:

```
Called by: .devcontainer/scripts/on-create.sh (planned)
Called by: .github/workflows/copilot-setup-steps.yml (planned)
```

Both are live today. `.devcontainer/scripts/on-create.sh:87` runs `pwsh -NoProfile -File scripts/security/Install-PSModules.ps1 -Repository "${PSGALLERY_REPO}"`, and `.github/workflows/copilot-setup-steps.yml:92` runs `& "$env:GITHUB_WORKSPACE/scripts/security/Install-PSModules.ps1" -Scope CurrentUser -Repository $repo`.

The third entry, `.github/actions/setup-ps-modules/action.yml`, carries no tag and is correct.

Effect is small but pointed at contributors: anyone reading the help to work out where this script runs will conclude the devcontainer and the Copilot setup workflow do not use it yet, and that is no longer true.

Happy to send the two-line change dropping both `(planned)` tags if that is welcome.

Open scripts/security/Install-PSModules.ps1 and inspect the .NOTES block around lines 49-50. Confirm the callers in .devcontainer/scripts/on-create.sh:87 and .github/workflows/copilot-setup-steps.yml:92, then remove the two incorrect (planned) tags while leaving the action.yml entry unchanged.

Written by the indexing model from the issue text.