feat(sprint2): fix critical and high-priority bugs

C1: composite action selects Linux/Windows template from GITEA_CI_LINUX_TEMPLATE_PATH
    based on resolved guest OS; build-nsis.yml adds belt-and-suspenders guest-os param.
C2: redact ExtraGuestEnv secrets in Invoke-RemoteBuild.ps1 (envPrefix never logged).
H2: composite action outputs block corrected; duplicate artifact-name input removed.
H3: Linux Mode 2 PAT now uses http.extraHeader (mirrors Windows branch, drops GIT_CLONE_URL).
H6: Setup-Host.ps1 directory array updated to canonical layout (adds State, ip-leases, keys,
    Cache\pip, WinBuild2025/2022/LinuxBuild2404; removes obsolete WinBuild).
H7: Backup-CITemplate.ps1 default TemplatePath -> WinBuild2025; -AllTemplates switch added.
H8: Setup-Host.ps1 adds StrictHostKeyChecking=accept-new and Step 8 to replicate SSH config
    to LocalSystem profile for act_runner service account.
H11: runner/config.yaml adds GITEA_CI_SCRIPT_ROOT env var; action.yml uses it in place of
     hardcoded N:\ path.
Also: Invoke-RemoteBuild.ps1 skips 7-Zip/Compress-Archive when artifact source dir does not
     exist (fixes burn-in smoke runs with exit-0 build command and no output).

Setup-Host.ps1

@@ -114,13 +114,20 @@ if (-not $ActRunnerConfigYaml) { $ActRunnerConfigYaml = Join-Path $scriptDir 'ru
 # ── Step 1: Create F:\CI\ directory tree ─────────────────────────────────────
 Write-Step "Creating CI directory tree under $CIRoot"
 
+# Canonical layout — see AGENTS.md §Struttura directory host
 $dirs = @(
     "$CIRoot\BuildVMs",
     "$CIRoot\Artifacts",
     "$CIRoot\Logs",
-    "$CIRoot\Templates\WinBuild",
+    "$CIRoot\Templates\WinBuild2025",
+    "$CIRoot\Templates\WinBuild2022",
+    "$CIRoot\Templates\LinuxBuild2404",
+    "$CIRoot\State",
+    "$CIRoot\State\ip-leases",
+    "$CIRoot\keys",
     "$CIRoot\act_runner\logs",
     "$CIRoot\Cache\NuGet",
+    "$CIRoot\Cache\pip",
     "$CIRoot\RunnerWork",
     "$CIRoot\ISO"
 )
@@ -306,6 +313,7 @@ Host gitea-ci
     Port     $GiteaSSHPort
     User     git
     IdentityFile ~/.ssh/id_rsa
+    StrictHostKeyChecking accept-new
 "@
 
     $existingConfig = ''
@@ -318,7 +326,66 @@ Host gitea-ci
     } else {
         Add-Content -Path $sshConfig -Value $aliasBlock -Encoding UTF8
         Write-OK "SSH alias 'gitea-ci' written to $sshConfig"
-        Write-Warn "Ensure your public SSH key is registered in Gitea under User Settings → SSH Keys."
+        Write-Warn "Ensure your public SSH key is registered in Gitea under User Settings -> SSH Keys."
+    }
+}
+
+# ── Step 8: Replicate SSH config to LocalSystem profile ──────────────────────
+# act_runner runs as LocalSystem; its SSH home differs from the interactive
+# user's USERPROFILE. Copy .ssh/config and the private key so that
+# 'ssh gitea-ci' works when invoked from act_runner jobs.
+if ($SkipSSHConfig) {
+    Write-Host "`n=== SSH LocalSystem replication SKIPPED (-SkipSSHConfig) ===" -ForegroundColor Yellow
+}
+else {
+    Write-Step "Replicating SSH config to LocalSystem profile (H8 — act_runner fix)"
+
+    $localSystemSsh    = Join-Path $env:SystemRoot 'System32\config\systemprofile\.ssh'
+    $sourceSshDir      = Join-Path $env:USERPROFILE '.ssh'
+    $sourceConfigPath  = Join-Path $sourceSshDir 'config'
+    $sourceKeyPath     = Join-Path $sourceSshDir 'id_rsa'
+    $sourceKnownHosts  = Join-Path $sourceSshDir 'known_hosts'
+
+    if (-not (Test-Path $localSystemSsh)) {
+        New-Item -ItemType Directory -Path $localSystemSsh -Force | Out-Null
+        Write-OK "Created $localSystemSsh"
+    }
+
+    # Copy config
+    if (Test-Path $sourceConfigPath) {
+        Copy-Item -Path $sourceConfigPath -Destination (Join-Path $localSystemSsh 'config') -Force
+        Write-OK "SSH config copied to $localSystemSsh\config"
+    }
+    else {
+        Write-Warn "Source SSH config not found at $sourceConfigPath — skipping config copy."
+    }
+
+    # Copy private key and lock down permissions
+    if (Test-Path $sourceKeyPath) {
+        $destKeyPath = Join-Path $localSystemSsh 'id_rsa'
+        Copy-Item -Path $sourceKeyPath -Destination $destKeyPath -Force
+
+        $acl = New-Object System.Security.AccessControl.FileSecurity
+        $acl.SetAccessRuleProtection($true, $false)
+        $acl.AddAccessRule(
+            (New-Object System.Security.AccessControl.FileSystemAccessRule(
+                'NT AUTHORITY\SYSTEM', 'FullControl', 'Allow')))
+        $acl.AddAccessRule(
+            (New-Object System.Security.AccessControl.FileSystemAccessRule(
+                'BUILTIN\Administrators', 'FullControl', 'Allow')))
+        Set-Acl -Path $destKeyPath -AclObject $acl
+        Write-OK "SSH private key copied and ACLs locked to SYSTEM/Administrators at $destKeyPath"
+    }
+    else {
+        Write-Warn "SSH private key not found at $sourceKeyPath — skipping key copy."
+        Write-Warn "Generate a key with: ssh-keygen -t rsa -b 4096 -f $sourceKeyPath -N ''"
+        Write-Warn "Then re-run Setup-Host.ps1."
+    }
+
+    # Copy known_hosts if it exists (avoids first-connect host-key prompt)
+    if (Test-Path $sourceKnownHosts) {
+        Copy-Item -Path $sourceKnownHosts -Destination (Join-Path $localSystemSsh 'known_hosts') -Force
+        Write-OK "known_hosts copied to LocalSystem profile."
     }
 }