feat(template): add -SkipTier2 switch to skip Tier-2 toolchain installation

Setup-WinBuild2025.ps1:
  - New [switch] \ param (after \)
  - Step 12 block wrapped with if (\) { skip-message } else { ... }
  - Final gate Tier-2 Assert-Step wrapped with if (-not \)

Prepare-WinBuild2025.ps1:
  - New [switch] \ param forwarded to Setup via setupArgs

Validate-SetupState.ps1:
  - New [switch] \ param
  - \ passed into both remote scriptblocks via -ArgumentList
  - Tier-2 Chk calls guarded with if (-not \) in both blocks

template/Validate-SetupState.ps1

@@ -45,7 +45,10 @@ param(
     [string] $BuildUsername  = 'ci_build',
     [string] $DotNetChannel  = '10.0',
     [string] $PythonVersion  = '3.13.3',
-    [switch] $Remediate
+    [switch] $Remediate,
+
+    # Skip Tier-2 Toolchain checks (mirrors -SkipTier2 in Setup-WinBuild2025.ps1)
+    [switch] $SkipTier2
 )
 
 Set-StrictMode -Version Latest
@@ -77,7 +80,7 @@ try {
     $checks = Invoke-Command -ComputerName $VMIPAddress -Credential $cred `
         -Authentication Basic -UseSSL -Port 5986 -SessionOption $so -ScriptBlock {
 
-        param($BuildUsername, $DotNetChannel, $PythonVersion)
+        param($BuildUsername, $DotNetChannel, $PythonVersion, $SkipTier2)
 
         $results = [System.Collections.Generic.List[PSCustomObject]]::new()
 
@@ -229,6 +232,7 @@ try {
         }
 
         # Tier-2 Toolchain (§6.6)
+        if (-not $SkipTier2) {
         Chk 'PowerShell 7 (pwsh.exe in PATH)' {
             Get-Command pwsh -ErrorAction SilentlyContinue
         }
@@ -253,6 +257,7 @@ try {
         Chk 'vcpkg.exe present' {
             Test-Path 'C:\BuildTools\vcpkg\vcpkg.exe' -PathType Leaf
         }
+        } # end if (-not $SkipTier2)
 
         # No leftover installer files in C:\CI root
         Chk 'no leftover installer scripts in C:\CI' {
@@ -263,7 +268,7 @@ try {
 
         return $results.ToArray()
 
-    } -ArgumentList $BuildUsername, $DotNetChannel, $PythonVersion
+    } -ArgumentList $BuildUsername, $DotNetChannel, $PythonVersion, $SkipTier2
 
     Write-Host ''
     $failed   = 0
@@ -330,7 +335,7 @@ try {
     $checks = Invoke-Command -ComputerName $VMIPAddress -Credential $cred `
         -Authentication Basic -UseSSL -Port 5986 -SessionOption $so -ScriptBlock {
 
-        param($BuildUsername, $DotNetChannel, $PythonVersion)
+        param($BuildUsername, $DotNetChannel, $PythonVersion, $SkipTier2)
         $results = [System.Collections.Generic.List[PSCustomObject]]::new()
         function Chk {
             param([string]$Name, [scriptblock]$Test)
@@ -373,6 +378,7 @@ try {
         Chk 'MSBuild.exe present' { $msb=Get-Command msbuild -EA SilentlyContinue; $msb -and (Test-Path $msb.Source) }
         Chk 'Git for Windows (git.exe in PATH)' { Get-Command git -ErrorAction SilentlyContinue }
         Chk '7-Zip (7z.exe in PATH)' { Get-Command 7z -ErrorAction SilentlyContinue }
+        if (-not $SkipTier2) {
         Chk 'PowerShell 7 (pwsh.exe in PATH)' { Get-Command pwsh -ErrorAction SilentlyContinue }
         Chk 'NSIS (makensis.exe in PATH)' { Get-Command makensis -ErrorAction SilentlyContinue }
         Chk 'CMake (cmake.exe in PATH)' { Get-Command cmake -ErrorAction SilentlyContinue }
@@ -381,9 +387,10 @@ try {
         Chk 'GitHub CLI (gh.exe in PATH)' { Get-Command gh -ErrorAction SilentlyContinue }
         Chk 'Sysinternals PsExec.exe present' { Test-Path 'C:\BuildTools\Sysinternals\PsExec.exe' -PathType Leaf }
         Chk 'vcpkg.exe present' { Test-Path 'C:\BuildTools\vcpkg\vcpkg.exe' -PathType Leaf }
+        } # end if (-not $SkipTier2)
         Chk 'no leftover installer scripts in C:\CI' { $l=Get-ChildItem 'C:\CI' -File -EA SilentlyContinue | Where-Object { $_.Name -match 'wu_worker|wu_result|vs_buildtools|dotnet-install' }; $l.Count -eq 0 }
         return $results.ToArray()
-    } -ArgumentList $BuildUsername, $DotNetChannel, $PythonVersion
+    } -ArgumentList $BuildUsername, $DotNetChannel, $PythonVersion, $SkipTier2
 
     Write-Host ''
     $failed  = 0