Sprint 13-14: §6.2 composite action + §6.4 build matrix + §6.5 secret injection

§6.2 - New composite action gitea/actions/local-ci-build/action.yml
  Wraps Invoke-CIJob.ps1 for reuse across repos. Inputs: build-command,
  artifact-source, submodules, guest-os, use-git-clone, configuration,
  template-path, snapshot-name, artifact-name, artifact-retention-days.
  Anti-injection: all params via INPUT_* env vars, never interpolated in shell.

§6.4 - Build matrix windows+linux in build-nsis.yml
  gitea/workflows/build-nsis.yml rewritten with strategy.matrix target:
  [windows, linux], fail-fast: false, routes to {target}-build runner.
  Added action inputs: job-id-suffix (matrix disambig for artifact dirs),
  repo-url (SSH URL override for gitea-ci alias).

§6.5 - ExtraGuestEnv secret injection chain
  New param -ExtraGuestEnv [hashtable] in Invoke-CIJob.ps1 and
  Invoke-RemoteBuild.ps1. Windows: SetEnvironmentVariable in WinRM session
  ScriptBlock before build command. Linux: export KEY='val'; prefix before
  cd && buildcmd (POSIX single-quote escaping). Composite action input
  extra-guest-env-json (JSON object -> ConvertFrom-Json -> hashtable),
  never logged.

PSScriptAnalyzer fixes: _Common.psm1, Invoke-RetentionPolicy.ps1,
  Watch-RunnerHealth.ps1 (empty catch, ShouldProcess suppression, etc.)

Docs/test: TEST-PLAN-v1.3-to-HEAD.md updated §3.3/§6.1/§5.4 status.
  TODO.md: §6 fully closed (6.1-6.2 done, 6.3 deferred, 6.4-6.5 done, 6.6 done).

gitea/workflows/build-nsis.yml

@@ -1,13 +1,8 @@
 # Build (Local CI) — pipeline per nsis-plugin-nsinnounp
 #
-# Eseguito dal runner locale windows-build su WS1-W11.
-# L'orchestratore (Invoke-CIJob.ps1) gira sull'host e:
-#   1. Clona il repo sull'host (con submoduli)
-#   2. Crea una VM efimera da snapshot BaseClean
-#   3. Copia il sorgente nella VM via WinRM (zip transfer)
-#   4. Esegue python build_plugin.py nella VM
-#   5. Raccoglie artifacts.zip sull'host
-#   6. Distrugge la VM
+# Cross-platform matrix build: runs in parallel on both windows-build (WinRM)
+# and linux-build (SSH) runners using the reusable composite action.
+# Uses: Simone/local-ci-system/.gitea/actions/local-ci-build@main
 #
 # Trigger: push su tag v*, oppure run manuale
 
@@ -21,26 +16,23 @@ on:
 
 jobs:
   build:
-    runs-on: windows-build
+    strategy:
+      matrix:
+        target: [windows, linux]
+      fail-fast: false
+
+    # Runner label must match config.yaml labels: windows-build or linux-build
+    runs-on: ${{ matrix.target }}-build
 
     steps:
-      - name: Run CI Job
-        shell: powershell
-        run: |
-          & 'N:\Code\Workspace\Local-CI-CD-System\scripts\Invoke-CIJob.ps1' `
-            -JobId               '${{ github.run_id }}' `
-            -RepoUrl             'ssh://gitea-ci/Simone/nsis-plugin-nsinnounp.git' `
-            -Branch              '${{ github.ref_name }}' `
-            -Commit              '${{ github.sha }}' `
-            -TemplatePath        $env:GITEA_CI_TEMPLATE_PATH `
-            -Submodules `
-            -BuildCommand        'python build_plugin.py --final --dist-dir dist' `
-            -GuestArtifactSource 'dist'
-          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
-
-      - name: Upload artifacts
-        uses: actions/upload-artifact@v4
+      - uses: Simone/local-ci-system/.gitea/actions/local-ci-build@main
         with:
-          name: nsis-plugin-nsinnounp-${{ github.ref_name }}
-          path: F:\CI\Artifacts\${{ github.run_id }}\artifacts.zip
-          if-no-files-found: error
+          build-command:   'python build_plugin.py --final --dist-dir dist'
+          artifact-source: 'dist'
+          submodules:      'true'
+          # SSH URL alias configured in host ~/.ssh/config — same for both runners
+          repo-url:        'ssh://gitea-ci/Simone/nsis-plugin-nsinnounp.git'
+          # Suffix disambiguates artifact dirs: F:\CI\Artifacts\{run_id}-{attempt}-windows
+          job-id-suffix:   '${{ matrix.target }}'
+          artifact-name:   'nsis-plugin-nsinnounp-${{ matrix.target }}-${{ github.ref_name }}'
+