feat(build): live-stream Linux build output; ns7zip via in-guest clone

- SshTransport.run_streaming: incremental channel recv, forwards
  stdout/stderr live (no more one-block-at-end). _linux_build uses it
  with PYTHONUNBUFFERED so the guest python flushes promptly.
- _tail_lines split out for failure messages (no double print).
- Windows live streaming deferred (TODO 8.2) — pypsrp execute_ps
  returns only at completion.
- build-ns7zip.yml: use-git-clone:'true' (in-guest), repo-url ->
  https://gitea.emulab.it/... (guest-reachable; host SSH alias was
  host-only). Requires GiteaPAT in the LocalSystem keyring or a public
  nsis-plugin-ns7zip.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

tests/python/test_commands_build.py

@@ -53,6 +53,13 @@ class _FakeTransport:
             raise TransportCommandError(result.returncode, result.stdout, result.stderr)
         return result
 
+    def run_streaming(
+        self, script: str, *, check: bool = True, timeout: float | None = None
+    ) -> _FakeResult:
+        # Tests don't exercise live streaming; delegate to run() so
+        # capture + check semantics (and _BuildFails overrides) hold.
+        return self.run(script, check=check)
+
     def copy(self, local_path: str, remote_path: str) -> None:
         self.copies.append((str(local_path), remote_path))