Sprint 13-14: §6.2 composite action + §6.4 build matrix + §6.5 secret injection

§6.2 - New composite action gitea/actions/local-ci-build/action.yml
  Wraps Invoke-CIJob.ps1 for reuse across repos. Inputs: build-command,
  artifact-source, submodules, guest-os, use-git-clone, configuration,
  template-path, snapshot-name, artifact-name, artifact-retention-days.
  Anti-injection: all params via INPUT_* env vars, never interpolated in shell.

§6.4 - Build matrix windows+linux in build-nsis.yml
  gitea/workflows/build-nsis.yml rewritten with strategy.matrix target:
  [windows, linux], fail-fast: false, routes to {target}-build runner.
  Added action inputs: job-id-suffix (matrix disambig for artifact dirs),
  repo-url (SSH URL override for gitea-ci alias).

§6.5 - ExtraGuestEnv secret injection chain
  New param -ExtraGuestEnv [hashtable] in Invoke-CIJob.ps1 and
  Invoke-RemoteBuild.ps1. Windows: SetEnvironmentVariable in WinRM session
  ScriptBlock before build command. Linux: export KEY='val'; prefix before
  cd && buildcmd (POSIX single-quote escaping). Composite action input
  extra-guest-env-json (JSON object -> ConvertFrom-Json -> hashtable),
  never logged.

PSScriptAnalyzer fixes: _Common.psm1, Invoke-RetentionPolicy.ps1,
  Watch-RunnerHealth.ps1 (empty catch, ShouldProcess suppression, etc.)

Docs/test: TEST-PLAN-v1.3-to-HEAD.md updated §3.3/§6.1/§5.4 status.
  TODO.md: §6 fully closed (6.1-6.2 done, 6.3 deferred, 6.4-6.5 done, 6.6 done).

scripts/Invoke-RemoteBuild.ps1

@@ -140,7 +140,11 @@ param(
     [string] $GuestLinuxWorkDir = '/opt/ci/build',
 
     # Output directory inside the Linux guest.
-    [string] $GuestLinuxOutputDir = '/opt/ci/output'
+    [string] $GuestLinuxOutputDir = '/opt/ci/output',
+
+    # Extra environment variables injected into the guest before the build command (§6.5).
+    # Keys must be valid env var names. Values are plain strings (never logged).
+    [hashtable] $ExtraGuestEnv = @{}
 )
 
 Set-StrictMode -Version Latest
@@ -239,10 +243,16 @@ if ($GuestOS -eq 'Linux') {
     }
 
     # Step 3: Run build command (always cd into workdir first)
+    # Prepend extra env exports (§6.5) — scoped to this SSH command only
+    $envPrefix = ''
+    foreach ($envKey in $ExtraGuestEnv.Keys) {
+        $envVal = $ExtraGuestEnv[$envKey] -replace "'", "'\''"  # escape ' for POSIX single-quoted string
+        $envPrefix += "export $envKey='$envVal'; "
+    }
     if ($BuildCommand -ne '') {
-        $buildCmd = "cd '$GuestLinuxWorkDir' && $BuildCommand"
+        $buildCmd = "${envPrefix}cd '$GuestLinuxWorkDir' && $BuildCommand"
     } else {
-        $buildCmd = "cd '$GuestLinuxWorkDir' && make"
+        $buildCmd = "${envPrefix}cd '$GuestLinuxWorkDir' && make"
     }
     Write-Host "[Invoke-RemoteBuild] Running build: $buildCmd"
     Invoke-SshCommand -IP $IPAddress -User $SshUser -KeyPath $SshKeyPath -Command $buildCmd
@@ -401,12 +411,16 @@ try {
         # ── Custom build command (e.g. python, msbuild, cmake…) ──────────
         Write-Host "[Invoke-RemoteBuild] Running build command: $BuildCommand"
         $buildExit = Invoke-Command -Session $session -ScriptBlock {
-            param($workDir, $cmd, $artifactZip, $artifactSrc, $useCache)
+            param($workDir, $cmd, $artifactZip, $artifactSrc, $useCache, $extraEnv)
             # Unbuffered Python output — lines appear in real-time instead of being held in buffer
             $env:PYTHONUNBUFFERED = '1'
             if ($useCache) {
                 $env:PIP_CACHE_DIR = '\\vmware-host\Shared Folders\pip-cache'
             }
+            # Inject extra env vars (§6.5 secret injection)
+            foreach ($pair in $extraEnv.GetEnumerator()) {
+                [System.Environment]::SetEnvironmentVariable($pair.Key, $pair.Value, 'Process')
+            }
             Set-Location $workDir
             # Stream each output line via Write-Host — WinRM forwards Write-Host in real-time
             & cmd /c "$cmd 2>&1" | ForEach-Object { Write-Host $_ }
@@ -430,7 +444,7 @@ try {
             }
 
             return $exit
-        } -ArgumentList $GuestWorkDir, $BuildCommand, $GuestArtifactZip, $GuestArtifactSource, $UseSharedCache.IsPresent
+        } -ArgumentList $GuestWorkDir, $BuildCommand, $GuestArtifactZip, $GuestArtifactSource, $UseSharedCache.IsPresent, $ExtraGuestEnv
 
         if ($buildExit -ne 0) {
             throw "Build command failed (exit $buildExit)"