Sprint 13-14: §6.2 composite action + §6.4 build matrix + §6.5 secret injection

§6.2 - New composite action gitea/actions/local-ci-build/action.yml
  Wraps Invoke-CIJob.ps1 for reuse across repos. Inputs: build-command,
  artifact-source, submodules, guest-os, use-git-clone, configuration,
  template-path, snapshot-name, artifact-name, artifact-retention-days.
  Anti-injection: all params via INPUT_* env vars, never interpolated in shell.

§6.4 - Build matrix windows+linux in build-nsis.yml
  gitea/workflows/build-nsis.yml rewritten with strategy.matrix target:
  [windows, linux], fail-fast: false, routes to {target}-build runner.
  Added action inputs: job-id-suffix (matrix disambig for artifact dirs),
  repo-url (SSH URL override for gitea-ci alias).

§6.5 - ExtraGuestEnv secret injection chain
  New param -ExtraGuestEnv [hashtable] in Invoke-CIJob.ps1 and
  Invoke-RemoteBuild.ps1. Windows: SetEnvironmentVariable in WinRM session
  ScriptBlock before build command. Linux: export KEY='val'; prefix before
  cd && buildcmd (POSIX single-quote escaping). Composite action input
  extra-guest-env-json (JSON object -> ConvertFrom-Json -> hashtable),
  never logged.

PSScriptAnalyzer fixes: _Common.psm1, Invoke-RetentionPolicy.ps1,
  Watch-RunnerHealth.ps1 (empty catch, ShouldProcess suppression, etc.)

Docs/test: TEST-PLAN-v1.3-to-HEAD.md updated §3.3/§6.1/§5.4 status.
  TODO.md: §6 fully closed (6.1-6.2 done, 6.3 deferred, 6.4-6.5 done, 6.6 done).

gitea/workflow-example.yml

@@ -166,3 +166,52 @@ jobs:
 #           path: F:\CI\Artifacts\${{ github.run_id }}-${{ github.run_attempt }}-${{ matrix.target }}\
 #           retention-days: 14
 #           if-no-files-found: error
+
+---
+# COMPOSITE ACTION VARIANT (recommended for new repositories)
+# Uses the reusable composite action stored in the CI system repository.
+# This variant replaces the verbose inline shell block with a single `uses:` step.
+# The composite action handles: Invoke-CIJob.ps1 call + artifact upload + log upload.
+#
+# Reference: gitea/actions/local-ci-build/action.yml in this repository.
+# Deployed path in Gitea: Simone/local-ci-system / .gitea/actions/local-ci-build/action.yml
+#
+# Minimum example (Windows build, Python project with submodules):
+#
+# name: Build (Composite)
+#
+# on:
+#   push:
+#     tags:
+#       - 'v*'
+#   workflow_dispatch:
+#
+# jobs:
+#   build:
+#     runs-on: windows-build
+#     steps:
+#       - uses: actions/checkout@v4
+#       - uses: Simone/local-ci-system/.gitea/actions/local-ci-build@main
+#         with:
+#           build-command: 'python build_plugin.py --final --dist-dir dist'
+#           artifact-source: 'dist'
+#           submodules: 'true'
+#
+# Cross-platform matrix variant using the composite action:
+#
+# jobs:
+#   build:
+#     strategy:
+#       matrix:
+#         target: [windows, linux]
+#       fail-fast: false
+#     runs-on: ${{ matrix.target }}-build
+#     steps:
+#       - uses: actions/checkout@v4
+#       - uses: Simone/local-ci-system/.gitea/actions/local-ci-build@main
+#         with:
+#           build-command: 'python build_plugin.py --final --dist-dir dist'
+#           artifact-source: 'dist'
+#           submodules: 'true'
+#           guest-os: 'Auto'
+#           artifact-name: 'build-${{ matrix.target }}-${{ github.sha }}'