codex update fails on Windows when Windows PowerShell 5.1's Get-FileHash is unavailable (even when invoked from PowerShell 7)

Title: codex update fails when Windows PowerShell 5.1 lacks Get-FileHash, even when run from PowerShell 7

Description

codex update always shells out to powershell.exe (Windows PowerShell 5.1) internally, regardless of which shell the user is actually running codex from. If Windows PowerShell 5.1's Microsoft.PowerShell.Utility module fails to load in that environment (e.g. PSModulePath is missing the system modules directory), Get-FileHash is unavailable in the spawned 5.1 session, and the update fails — even when codex update is invoked from PowerShell 7, where Get-FileHash resolves fine.

Steps to reproduce

1. On Windows, have an environment where Windows PowerShell 5.1's Get-FileHash fails to resolve (e.g. a broken or overridden PSModulePath)
2. Run codex update from PowerShell 7 (pwsh)
3. The update still shells out to powershell -ExecutionPolicy Bypass -c '...' internally and fails with the same error, regardless of the calling shell

Error output

==> Downloading Codex CLI
WARNUNG: Could not download or verify https://releases.openai.com/codex/releases/0.155.1/codex-package_SHA256SUMS;
retrying from GitHub Releases.
iex : Die Benennung "Get-FileHash" wurde nicht als Name eines Cmdlet, einer Funktion, einer Skriptdatei oder eines
ausführbaren Programms erkannt.
...
Error: `powershell -ExecutionPolicy Bypass -c '$env:CODEX_NON_INTERACTIVE=1; irm https://chatgpt.com/codex/install.ps1 | iex'` failed with status exit code: 1

Expected behavior

codex update should succeed regardless of the host system's PowerShell 5.1 module-loading state. Two possible fixes:

1. Prefer pwsh over powershell.exe when pwsh is available on PATH, or
2. Compute the checksum in install.ps1 via .NET APIs directly ([System.Security.Cryptography.SHA256]) instead of depending on the Get-FileHash cmdlet — this avoids the dependency on Microsoft.PowerShell.Utility being loaded at all, and works identically across PowerShell 5.1 and 7+.

Environment

• OS: Windows
• Codex CLI version: 0.147.0, attempting update to 0.155.1
• Shell used to invoke codex update: PowerShell 7.6.6 (pwsh)
• Underlying failure occurs in the spawned Windows PowerShell 5.1 process, not in pwsh itself

Start with install.ps1 and the code path used by codex update to invoke powershell.exe and verify the downloaded package. Reproduce the failure on Windows with the described PowerShell module state, then confirm that the update completes successfully without relying on the unavailable Get-FileHash cmdlet.