feat(sprint3): Invoke-VmrunBounded, Get-GuestIPAddress, transport and concurrency hardening

H4: Invoke-VmrunBounded added to _Common.psm1 (Start-Process + Wait-Process + taskkill on
    timeout, returns {ExitCode;Output;TimedOut;ElapsedSeconds}). Wired in Invoke-CIJob.ps1
    for vmrun start (180s) and Remove-BuildVM.ps1 for stop/deleteVM (60s/90s).
H5: Cleanup-OrphanedBuildVMs.ps1 removes stale vm-start.lock (>30 min). ValidateRange
    lowered to 0 to allow emergency -MaxAgeHours 0. Invoke-RetentionPolicy.ps1 same.
H8: _Transport.psm1 SSH hardening: StrictHostKeyChecking=accept-new, F:\CI\State\known_hosts.
H9: Validate-DeployState.ps1 Linux branch added: checks ci-report-ip.service enabled,
    ci-report-ip.sh executable via SSH. New params: -GuestOS, -SshKeyPath, -SshUser.
H12: Get-GuestIPAddress extracted into _Common.psm1 (guestinfo.ci-ip primary, getGuestIPAddress
     fallback). Invoke-CIJob.ps1 Phase 3b replaced with single call. Measure-CIBenchmark.ps1
     updated to match.
Also: _Common.psm1 adds Write-CIRedactedCommand and ConvertTo-SafeShellSingleQuotedString.
     Pester suite updated: 30/30 pass.

tests/_Common.Tests.ps1

@@ -88,3 +88,94 @@ Describe 'Invoke-Vmrun' {
         $env:FAKE_VMRUN_EXIT = $null
     }
 }
+
+# ─────────────────────────────────────────────────────────────────────────────
+Describe 'Invoke-VmrunBounded' {
+    BeforeAll {
+        # Fake vmrun that sleeps for $FAKE_VMRUN_SLEEP seconds then exits with
+        # $FAKE_VMRUN_EXIT. Both default to 0 if unset.
+        $script:SlowFakeVmrun = Join-Path $env:TEMP "fake-vmrun-slow-$PID.cmd"
+        Set-Content $script:SlowFakeVmrun -Value @'
+@echo off
+if "%FAKE_VMRUN_SLEEP%"=="" goto :nosleep
+ping -n %FAKE_VMRUN_SLEEP% 127.0.0.1 >nul
+:nosleep
+echo fake-vmrun-bounded-output
+if "%FAKE_VMRUN_EXIT%"=="" ( exit /b 0 ) else ( exit /b %FAKE_VMRUN_EXIT% )
+'@
+    }
+
+    AfterAll {
+        Remove-Item $script:SlowFakeVmrun -Force -ErrorAction SilentlyContinue
+    }
+
+    AfterEach {
+        $env:FAKE_VMRUN_EXIT  = $null
+        $env:FAKE_VMRUN_SLEEP = $null
+    }
+
+    It 'returns ExitCode 0, TimedOut false and Output when command succeeds quickly' {
+        $env:FAKE_VMRUN_EXIT  = '0'
+        $env:FAKE_VMRUN_SLEEP = '0'
+        $r = Invoke-VmrunBounded -VmrunPath $script:SlowFakeVmrun -Operation 'start' -Arguments @('some.vmx', 'nogui') -TimeoutSeconds 30
+        $r.ExitCode    | Should -Be 0
+        $r.TimedOut    | Should -Be $false
+        "$($r.Output)" | Should -Match 'fake-vmrun-bounded-output'
+        $r.ElapsedSeconds | Should -BeGreaterOrEqual 0
+    }
+
+    It 'returns non-zero ExitCode without throwing by default' {
+        $env:FAKE_VMRUN_EXIT  = '3'
+        $env:FAKE_VMRUN_SLEEP = '0'
+        $r = Invoke-VmrunBounded -VmrunPath $script:SlowFakeVmrun -Operation 'deleteVM' -TimeoutSeconds 30
+        $r.ExitCode | Should -Be 3
+        $r.TimedOut | Should -Be $false
+    }
+
+    It 'throws when -ThrowOnError and ExitCode is non-zero' {
+        $env:FAKE_VMRUN_EXIT  = '2'
+        $env:FAKE_VMRUN_SLEEP = '0'
+        { Invoke-VmrunBounded -VmrunPath $script:SlowFakeVmrun -Operation 'stop' -TimeoutSeconds 30 -ThrowOnError } |
+            Should -Throw -ExpectedMessage '*stop failed*'
+    }
+
+    It 'does not throw when -ThrowOnError and ExitCode is 0' {
+        $env:FAKE_VMRUN_EXIT  = '0'
+        $env:FAKE_VMRUN_SLEEP = '0'
+        { Invoke-VmrunBounded -VmrunPath $script:SlowFakeVmrun -Operation 'start' -TimeoutSeconds 30 -ThrowOnError } |
+            Should -Not -Throw
+    }
+
+    It 'times out and returns TimedOut = true when process exceeds TimeoutSeconds' {
+        # FAKE_VMRUN_SLEEP uses ping -n N which waits roughly (N-1) seconds.
+        # Set sleep >> timeout so the process is guaranteed to still be running.
+        $env:FAKE_VMRUN_SLEEP = '60'
+        $env:FAKE_VMRUN_EXIT  = '0'
+        $r = Invoke-VmrunBounded -VmrunPath $script:SlowFakeVmrun -Operation 'start' -TimeoutSeconds 2
+        $r.TimedOut    | Should -Be $true
+        $r.ExitCode    | Should -Be -1
+        $r.ElapsedSeconds | Should -BeLessOrEqual 10   # killed well before 60s
+    }
+
+    It 'throws when -ThrowOnTimeout and process times out' {
+        $env:FAKE_VMRUN_SLEEP = '60'
+        $env:FAKE_VMRUN_EXIT  = '0'
+        { Invoke-VmrunBounded -VmrunPath $script:SlowFakeVmrun -Operation 'deleteVM' -TimeoutSeconds 2 -ThrowOnTimeout } |
+            Should -Throw -ExpectedMessage '*timed out*'
+    }
+
+    It 'does not throw on timeout when neither flag is set' {
+        $env:FAKE_VMRUN_SLEEP = '60'
+        $env:FAKE_VMRUN_EXIT  = '0'
+        { Invoke-VmrunBounded -VmrunPath $script:SlowFakeVmrun -Operation 'start' -TimeoutSeconds 2 } |
+            Should -Not -Throw
+    }
+
+    It 'ElapsedSeconds is populated and plausible' {
+        $env:FAKE_VMRUN_EXIT  = '0'
+        $env:FAKE_VMRUN_SLEEP = '0'
+        $r = Invoke-VmrunBounded -VmrunPath $script:SlowFakeVmrun -Operation 'list' -TimeoutSeconds 30
+        $r.ElapsedSeconds | Should -BeGreaterOrEqual 0
+        $r.ElapsedSeconds | Should -BeLessThan 30
+    }
+}