feat(build): live-stream Linux build output; ns7zip via in-guest clone

- SshTransport.run_streaming: incremental channel recv, forwards
  stdout/stderr live (no more one-block-at-end). _linux_build uses it
  with PYTHONUNBUFFERED so the guest python flushes promptly.
- _tail_lines split out for failure messages (no double print).
- Windows live streaming deferred (TODO 8.2) — pypsrp execute_ps
  returns only at completion.
- build-ns7zip.yml: use-git-clone:'true' (in-guest), repo-url ->
  https://gitea.emulab.it/... (guest-reachable; host SSH alias was
  host-only). Requires GiteaPAT in the LocalSystem keyring or a public
  nsis-plugin-ns7zip.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.gitea/workflows/build-ns7zip.yml

@@ -35,12 +35,14 @@ jobs:
           artifact-source: 'dist'
           submodules:      'true'
           guest-os:        ${{ matrix.target == 'linux' && 'Linux' || 'Windows' }}
-          # repo-url uses the host SSH alias `gitea-ci` (~/.ssh/config),
-          # which exists only on the host — so the clone MUST run on the
-          # host, not in the guest. use-git-clone:'false' selects the
-          # host-side clone + zip transfer transport.
-          use-git-clone:   'false'
-          repo-url:        'ssh://gitea-ci/Simone/nsis-plugin-ns7zip.git'
+          # In-guest clone (default). repo-url must be reachable FROM the
+          # guest (VMnet8 NAT -> gitea.emulab.it), not the host-only SSH
+          # alias. ci_orchestrator injects the GiteaPAT credential into
+          # the HTTPS URL, so GiteaPAT must exist in the LocalSystem
+          # keyring (Set-CIGuestCredential.ps1 -Target GiteaPAT) — or
+          # nsis-plugin-ns7zip must be public.
+          use-git-clone:   'true'
+          repo-url:        'https://gitea.emulab.it/Simone/nsis-plugin-ns7zip.git'
           # Cross-repo build: github.ref_name is this repo's branch, not
           # nsis-plugin-ns7zip's. Pin the target repo's branch.
           repo-branch:     'main'