Sprint 13-14: §6.2 composite action + §6.4 build matrix + §6.5 secret injection

§6.2 - New composite action gitea/actions/local-ci-build/action.yml
  Wraps Invoke-CIJob.ps1 for reuse across repos. Inputs: build-command,
  artifact-source, submodules, guest-os, use-git-clone, configuration,
  template-path, snapshot-name, artifact-name, artifact-retention-days.
  Anti-injection: all params via INPUT_* env vars, never interpolated in shell.

§6.4 - Build matrix windows+linux in build-nsis.yml
  gitea/workflows/build-nsis.yml rewritten with strategy.matrix target:
  [windows, linux], fail-fast: false, routes to {target}-build runner.
  Added action inputs: job-id-suffix (matrix disambig for artifact dirs),
  repo-url (SSH URL override for gitea-ci alias).

§6.5 - ExtraGuestEnv secret injection chain
  New param -ExtraGuestEnv [hashtable] in Invoke-CIJob.ps1 and
  Invoke-RemoteBuild.ps1. Windows: SetEnvironmentVariable in WinRM session
  ScriptBlock before build command. Linux: export KEY='val'; prefix before
  cd && buildcmd (POSIX single-quote escaping). Composite action input
  extra-guest-env-json (JSON object -> ConvertFrom-Json -> hashtable),
  never logged.

PSScriptAnalyzer fixes: _Common.psm1, Invoke-RetentionPolicy.ps1,
  Watch-RunnerHealth.ps1 (empty catch, ShouldProcess suppression, etc.)

Docs/test: TEST-PLAN-v1.3-to-HEAD.md updated §3.3/§6.1/§5.4 status.
  TODO.md: §6 fully closed (6.1-6.2 done, 6.3 deferred, 6.4-6.5 done, 6.6 done).

scripts/Invoke-CIJob.ps1

@@ -134,7 +134,12 @@ param(
     [string] $GuestOS = 'Auto',
 
     [string] $SshKeyPath = 'F:\CI\keys\ci_linux',
-    [string] $SshUser    = 'ci_build'
+    [string] $SshUser    = 'ci_build',
+
+    # Extra environment variables injected into the guest VM before the build command (§6.5).
+    # Keys must be valid environment variable names. Values must be plain strings.
+    # Example: @{ SIGN_PASS = $env:SIGN_PASS_FROM_SECRET; GPG_KEY_ID = '0xABCD1234' }
+    [hashtable] $ExtraGuestEnv = @{}
 )
 
 Set-StrictMode -Version Latest
@@ -206,7 +211,7 @@ function Write-JobEvent {
         [hashtable] $Data = @{}
     )
     if (-not $script:jsonLog) { return }
-    $event = [ordered]@{
+    $logEntry = [ordered]@{
         ts     = (Get-Date -Format 'o')
         jobId  = $script:JobId
         phase  = $Phase
@@ -214,9 +219,9 @@ function Write-JobEvent {
         data   = $Data
     }
     try {
-        $event | ConvertTo-Json -Compress -Depth 5 |
+        $logEntry | ConvertTo-Json -Compress -Depth 5 |
             Add-Content -Path $script:jsonLog -Encoding UTF8 -ErrorAction Stop
-    } catch { }  # never let logging break the build
+    } catch { Write-Debug "[Write-JobEvent] Logging skipped: $_" }  # never let logging fail the build
 }
 
 Write-Host "============================================================"
@@ -481,6 +486,7 @@ try {
     }
     if ($BuildCommand -ne '')        { $remoteBuildParams['BuildCommand']        = $BuildCommand }
     if ($GuestArtifactSource -ne '') { $remoteBuildParams['GuestArtifactSource'] = $GuestArtifactSource }
+    if ($ExtraGuestEnv.Count -gt 0)  { $remoteBuildParams['ExtraGuestEnv']       = $ExtraGuestEnv }
     & "$scriptDir\Invoke-RemoteBuild.ps1" @remoteBuildParams
     Write-JobEvent -Phase 'phase5.build' -Status 'success'
 
@@ -549,7 +555,7 @@ finally {
 
     # ── Stop transcript ───────────────────────────────────────────────────
     if ($transcriptStarted) {
-        try { Stop-Transcript -ErrorAction SilentlyContinue } catch {}
+        try { Stop-Transcript -ErrorAction SilentlyContinue } catch { Write-Debug "[Invoke-CIJob] Stop-Transcript ignored: $_" }
     }
 
     # ── Log retention: purge directories older than $LogRetentionDays days ─