feat(template): add -SkipTier2 switch to skip Tier-2 toolchain installation

Setup-WinBuild2025.ps1:
  - New [switch] \ param (after \)
  - Step 12 block wrapped with if (\) { skip-message } else { ... }
  - Final gate Tier-2 Assert-Step wrapped with if (-not \)

Prepare-WinBuild2025.ps1:
  - New [switch] \ param forwarded to Setup via setupArgs

Validate-SetupState.ps1:
  - New [switch] \ param
  - \ passed into both remote scriptblocks via -ArgumentList
  - Tier-2 Chk calls guarded with if (-not \) in both blocks

template/Prepare-WinBuild2025.ps1

@@ -141,6 +141,9 @@ param(
     [string] $GhCliVersion   = '2.67.0',
     [string] $VcpkgRef       = '',
 
+    # Skip Tier-2 Toolchain — forwarded to Setup-WinBuild2025.ps1 -SkipTier2
+    [switch] $SkipTier2,
+
     [switch] $SkipWindowsUpdate,
 
     # Skip disk cleanup inside the VM (cleanmgr + DISM + cache clear) — speeds up re-runs
@@ -386,6 +389,7 @@ try {
     }
     if ($SkipWindowsUpdate) { $setupArgs['SkipWindowsUpdate'] = $true }
     if ($SkipCleanup)       { $setupArgs['SkipCleanup']       = $true }
+    if ($SkipTier2)         { $setupArgs['SkipTier2']         = $true }
 
     # ── Run Setup-WinBuild2025.ps1 inside the VM ──────────────────────────────
     # Setup may return exit 3010 (ERROR_SUCCESS_REBOOT_REQUIRED) when Windows

template/Setup-WinBuild2025.ps1

@@ -178,7 +178,12 @@ param(
     [string] $GhCliVersion = '2.67.0',
 
     # vcpkg revision: git commit SHA or tag. Default '' = shallow HEAD clone.
-    [string] $VcpkgRef = ''
+    [string] $VcpkgRef = '',
+
+    # Skip Tier-2 Toolchain installation (PowerShell 7, NSIS, CMake, Node.js, WiX, gh CLI, Sysinternals, vcpkg).
+    # Use when rebuilding the template quickly without internet-heavy downloads, or
+    # when only Tier-1 tools are needed for a stripped-down template variant.
+    [switch] $SkipTier2
 )
 
 Set-StrictMode -Version Latest
@@ -1148,6 +1153,10 @@ Assert-Step '7-Zip' '7z command resolvable' {
 Write-Host "Tier-1 Toolchain installation complete." -ForegroundColor Green
 
 # ── Step 12: Tier-2 Toolchain ─────────────────────────────────────────────────
+if ($SkipTier2) {
+    Write-Host "`n[Setup] Skipping Tier-2 Toolchain (-SkipTier2 switch set)." -ForegroundColor Yellow
+}
+else {
 Write-Step "Installing Tier-2 Toolchain (Pwsh7 / NSIS / CMake / Node.js / WiX / gh CLI / Sysinternals / vcpkg)"
 
 # BuildTools root may already exist from Step 11 (idempotent).
@@ -1455,6 +1464,7 @@ Assert-Step 'vcpkg' 'vcpkg version exits 0' {
 }
 
 Write-Host "Tier-2 Toolchain installation complete." -ForegroundColor Green
+} # end if (-not $SkipTier2)
 
 # ── Cleanup ───────────────────────────────────────────────────────────────────
 if ($SkipCleanup) {
@@ -1637,7 +1647,8 @@ Assert-Step 'Final' 'git command available' {
 Assert-Step 'Final' '7z command available' {
     [bool](Get-Command 7z -ErrorAction SilentlyContinue)
 }
-Assert-Step 'Final' 'Tier-2 Toolchain all resolvable (pwsh, makensis, cmake, node, wix, gh, sysinternals, vcpkg)' {
+if (-not $SkipTier2) {
+    Assert-Step 'Final' 'Tier-2 Toolchain all resolvable (pwsh, makensis, cmake, node, wix, gh, sysinternals, vcpkg)' {
         $env:PATH = [System.Environment]::GetEnvironmentVariable('PATH', 'Machine') + ';' +
                     [System.Environment]::GetEnvironmentVariable('PATH', 'User')
         (Get-Command pwsh     -ErrorAction SilentlyContinue) -and
@@ -1648,6 +1659,7 @@ Assert-Step 'Final' 'Tier-2 Toolchain all resolvable (pwsh, makensis, cmake, nod
         (Get-Command gh       -ErrorAction SilentlyContinue) -and
         (Test-Path 'C:\BuildTools\Sysinternals\PsExec.exe' -PathType Leaf) -and
         (Test-Path 'C:\BuildTools\vcpkg\vcpkg.exe'         -PathType Leaf)
+    }
 }
 
 Write-Host "All pre-snapshot checks passed." -ForegroundColor Green

template/Validate-SetupState.ps1

@@ -45,7 +45,10 @@ param(
     [string] $BuildUsername  = 'ci_build',
     [string] $DotNetChannel  = '10.0',
     [string] $PythonVersion  = '3.13.3',
-    [switch] $Remediate
+    [switch] $Remediate,
+
+    # Skip Tier-2 Toolchain checks (mirrors -SkipTier2 in Setup-WinBuild2025.ps1)
+    [switch] $SkipTier2
 )
 
 Set-StrictMode -Version Latest
@@ -77,7 +80,7 @@ try {
     $checks = Invoke-Command -ComputerName $VMIPAddress -Credential $cred `
         -Authentication Basic -UseSSL -Port 5986 -SessionOption $so -ScriptBlock {
 
-        param($BuildUsername, $DotNetChannel, $PythonVersion)
+        param($BuildUsername, $DotNetChannel, $PythonVersion, $SkipTier2)
 
         $results = [System.Collections.Generic.List[PSCustomObject]]::new()
 
@@ -229,6 +232,7 @@ try {
         }
 
         # Tier-2 Toolchain (§6.6)
+        if (-not $SkipTier2) {
         Chk 'PowerShell 7 (pwsh.exe in PATH)' {
             Get-Command pwsh -ErrorAction SilentlyContinue
         }
@@ -253,6 +257,7 @@ try {
         Chk 'vcpkg.exe present' {
             Test-Path 'C:\BuildTools\vcpkg\vcpkg.exe' -PathType Leaf
         }
+        } # end if (-not $SkipTier2)
 
         # No leftover installer files in C:\CI root
         Chk 'no leftover installer scripts in C:\CI' {
@@ -263,7 +268,7 @@ try {
 
         return $results.ToArray()
 
-    } -ArgumentList $BuildUsername, $DotNetChannel, $PythonVersion
+    } -ArgumentList $BuildUsername, $DotNetChannel, $PythonVersion, $SkipTier2
 
     Write-Host ''
     $failed   = 0
@@ -330,7 +335,7 @@ try {
     $checks = Invoke-Command -ComputerName $VMIPAddress -Credential $cred `
         -Authentication Basic -UseSSL -Port 5986 -SessionOption $so -ScriptBlock {
 
-        param($BuildUsername, $DotNetChannel, $PythonVersion)
+        param($BuildUsername, $DotNetChannel, $PythonVersion, $SkipTier2)
         $results = [System.Collections.Generic.List[PSCustomObject]]::new()
         function Chk {
             param([string]$Name, [scriptblock]$Test)
@@ -373,6 +378,7 @@ try {
         Chk 'MSBuild.exe present' { $msb=Get-Command msbuild -EA SilentlyContinue; $msb -and (Test-Path $msb.Source) }
         Chk 'Git for Windows (git.exe in PATH)' { Get-Command git -ErrorAction SilentlyContinue }
         Chk '7-Zip (7z.exe in PATH)' { Get-Command 7z -ErrorAction SilentlyContinue }
+        if (-not $SkipTier2) {
         Chk 'PowerShell 7 (pwsh.exe in PATH)' { Get-Command pwsh -ErrorAction SilentlyContinue }
         Chk 'NSIS (makensis.exe in PATH)' { Get-Command makensis -ErrorAction SilentlyContinue }
         Chk 'CMake (cmake.exe in PATH)' { Get-Command cmake -ErrorAction SilentlyContinue }
@@ -381,9 +387,10 @@ try {
         Chk 'GitHub CLI (gh.exe in PATH)' { Get-Command gh -ErrorAction SilentlyContinue }
         Chk 'Sysinternals PsExec.exe present' { Test-Path 'C:\BuildTools\Sysinternals\PsExec.exe' -PathType Leaf }
         Chk 'vcpkg.exe present' { Test-Path 'C:\BuildTools\vcpkg\vcpkg.exe' -PathType Leaf }
+        } # end if (-not $SkipTier2)
         Chk 'no leftover installer scripts in C:\CI' { $l=Get-ChildItem 'C:\CI' -File -EA SilentlyContinue | Where-Object { $_.Name -match 'wu_worker|wu_result|vs_buildtools|dotnet-install' }; $l.Count -eq 0 }
         return $results.ToArray()
-    } -ArgumentList $BuildUsername, $DotNetChannel, $PythonVersion
+    } -ArgumentList $BuildUsername, $DotNetChannel, $PythonVersion, $SkipTier2
 
     Write-Host ''
     $failed  = 0