feat(sprint2): fix critical and high-priority bugs

C1: composite action selects Linux/Windows template from GITEA_CI_LINUX_TEMPLATE_PATH
    based on resolved guest OS; build-nsis.yml adds belt-and-suspenders guest-os param.
C2: redact ExtraGuestEnv secrets in Invoke-RemoteBuild.ps1 (envPrefix never logged).
H2: composite action outputs block corrected; duplicate artifact-name input removed.
H3: Linux Mode 2 PAT now uses http.extraHeader (mirrors Windows branch, drops GIT_CLONE_URL).
H6: Setup-Host.ps1 directory array updated to canonical layout (adds State, ip-leases, keys,
    Cache\pip, WinBuild2025/2022/LinuxBuild2404; removes obsolete WinBuild).
H7: Backup-CITemplate.ps1 default TemplatePath -> WinBuild2025; -AllTemplates switch added.
H8: Setup-Host.ps1 adds StrictHostKeyChecking=accept-new and Step 8 to replicate SSH config
    to LocalSystem profile for act_runner service account.
H11: runner/config.yaml adds GITEA_CI_SCRIPT_ROOT env var; action.yml uses it in place of
     hardcoded N:\ path.
Also: Invoke-RemoteBuild.ps1 skips 7-Zip/Compress-Archive when artifact source dir does not
     exist (fixes burn-in smoke runs with exit-0 build command and no output).

gitea/workflows/build-nsis.yml

@@ -30,6 +30,7 @@ jobs:
           build-command:   'python build_plugin.py --final --dist-dir dist'
           artifact-source: 'dist'
           submodules:      'true'
+          guest-os:        ${{ matrix.target == 'linux' && 'Linux' || 'Windows' }}
           # SSH URL alias configured in host ~/.ssh/config — same for both runners
           repo-url:        'ssh://gitea-ci/Simone/nsis-plugin-nsinnounp.git'
           # Suffix disambiguates artifact dirs: F:\CI\Artifacts\{run_id}-{attempt}-windows