security(sprint1): §1.1/1.3/1.4 — WinRM HTTPS/5986, SHA256 pinning infra, IP regex per-octet

§1.4 — Replace loose IP ValidatePattern with per-octet regex in 4 scripts
  (Invoke-CIJob, Invoke-RemoteBuild, Get-BuildArtifacts, Wait-VMReady)

§1.1 — Migrate all WinRM connections from HTTP/5985 to HTTPS/5986
  - Deploy post-install.ps1: remove AllowUnencrypted=true; self-signed cert + HTTPS listener
    already present; firewall rule restricted to 192.168.79.0/24
  - Setup-WinBuild2025.ps1: assert AllowUnencrypted=false
  - Prepare-WinBuild2025.ps1: preflight uses TCP/5986; Test-WSMan -UseSSL -Port 5986;
    New-PSSession -UseSSL -Port 5986; host AllowUnencrypted save/restore removed (not needed for HTTPS)
  - Invoke-RemoteBuild, Get-BuildArtifacts: New-PSSession -UseSSL -Port 5986 -Authentication Basic
  - Wait-VMReady: New-WSManSessionOption + Test-WSMan -Port 5986 -UseSSL
  - Validate-DeployState, Validate-SetupState: Invoke-Command -UseSSL -Port 5986,
    AllowUnencrypted check → false; AllowUnencrypted host-side removed from both
  - Docs: PLAN, README, ARCHITECTURE, BEST-PRACTICES, HOST-SETUP, WINDOWS-TEMPLATE-SETUP,
    LINUX-TEMPLATE-SETUP, TODO updated

§1.3 — SHA256 hash pinning infrastructure
  - Assert-Hash function + $script:Hashes hashtable added to Setup-WinBuild2025.ps1
  - Assert-Hash called after dotnet-install.ps1, python installer, vs_buildtools.exe downloads
  - Hashes initialized to '' (warn-skip); must be filled before next snapshot refresh

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

template/Deploy-WinBuild2025.ps1

@@ -43,8 +43,8 @@
         them after applying updates (§7.2 Strategy B)
       - Windows Firewall all profiles disabled (VMnet8 NAT lab; Setup Step 1 validates)
       - RDP enabled (no NLA, lab only) + firewall rules for RDP/ICMP/WinRM-HTTPS
-      - WinRM HTTP 5985 + HTTPS 5986 (self-signed cert), Basic auth,
-        AllowUnencrypted, TrustedHosts=*, MaxMemory=2048MB, IdleTimeout=2h, MaxProcesses=25
+      - WinRM HTTPS 5986 only (self-signed cert), Basic auth, AllowUnencrypted=false,
+        TrustedHosts=*, MaxMemory=2048MB, IdleTimeout=2h, MaxProcesses=25
       - ICMPv4 inbound allowed
       - Lock screen disabled, Server Manager (policy + HKLM + task + HKCU + Default hive),
         DisableCAD (Policies\System + Winlogon), OOBE/telemetry suppressed;
@@ -617,17 +617,17 @@ Enable-NetFirewallRule -DisplayGroup 'Remote Desktop' -ErrorAction SilentlyConti
 New-NetFirewallRule -DisplayName 'ICMPv4-In' -Protocol ICMPv4 -IcmpType 8 -Direction Inbound -Action Allow -Profile Any -ErrorAction SilentlyContinue | Out-Null
 L 'RDP + ICMP allowed'
 
-# ── WinRM HTTP + HTTPS, Basic+Unencrypted, TrustedHosts=* (lab only) ─────
+# ── WinRM HTTPS-only/5986, Basic auth over HTTPS, TrustedHosts=* (lab only) ─
+# AllowUnencrypted intentionally left false — all WinRM traffic uses HTTPS/5986.
 Enable-PSRemoting -Force -SkipNetworkProfileCheck | Out-Null
-winrm set winrm/config/service '@{AllowUnencrypted="true"}' | Out-Null
 winrm set winrm/config/service/auth '@{Basic="true"}' | Out-Null
 winrm set winrm/config/client/auth  '@{Basic="true"}' | Out-Null
 winrm set winrm/config/client '@{TrustedHosts="*"}' | Out-Null
 try {
     `$cert = New-SelfSignedCertificate -DnsName `$env:COMPUTERNAME -CertStoreLocation Cert:\LocalMachine\My
     New-Item -Path WSMan:\localhost\Listener -Transport HTTPS -Address * -CertificateThumbprint `$cert.Thumbprint -Force | Out-Null
-    New-NetFirewallRule -DisplayName 'WinRM-HTTPS' -Direction Inbound -Protocol TCP -LocalPort 5986 -Action Allow -Profile Any | Out-Null
-    L 'WinRM HTTPS listener configured'
+    New-NetFirewallRule -DisplayName 'WinRM-HTTPS' -Direction Inbound -Protocol TCP -LocalPort 5986 -Action Allow -Profile Any -RemoteAddress '192.168.79.0/24' | Out-Null
+    L 'WinRM HTTPS listener configured (port 5986, restricted to 192.168.79.0/24)'
 } catch { L "WinRM HTTPS failed: `$(`$_.Exception.Message)" }
 winrm set winrm/config/winrs '@{MaxProcessesPerShell="25"}' | Out-Null
 Set-Item WSMan:\localhost\Shell\MaxMemoryPerShellMB 2048   -Force 3>`$null
@@ -1107,8 +1107,7 @@ Write-Host "  Admin user : $AdminUser"
 Write-Host "  Snapshot   : $SnapshotName"
 Write-Host ""
 Write-Host "  RDP : mstsc /v:$guestIP"
-Write-Host "  WinRM HTTP  : 5985"
-Write-Host "  WinRM HTTPS : 5986 (self-signed)"
+Write-Host "  WinRM HTTPS : 5986 (self-signed, AllowUnencrypted=false)"
 Write-Host ""
 Write-Host "  Next steps (from template\ dir):"
 Write-Host "    .\Validate-DeployState.ps1 -VMIPAddress $guestIP"