feat(sprint2): fix critical and high-priority bugs

C1: composite action selects Linux/Windows template from GITEA_CI_LINUX_TEMPLATE_PATH
    based on resolved guest OS; build-nsis.yml adds belt-and-suspenders guest-os param.
C2: redact ExtraGuestEnv secrets in Invoke-RemoteBuild.ps1 (envPrefix never logged).
H2: composite action outputs block corrected; duplicate artifact-name input removed.
H3: Linux Mode 2 PAT now uses http.extraHeader (mirrors Windows branch, drops GIT_CLONE_URL).
H6: Setup-Host.ps1 directory array updated to canonical layout (adds State, ip-leases, keys,
    Cache\pip, WinBuild2025/2022/LinuxBuild2404; removes obsolete WinBuild).
H7: Backup-CITemplate.ps1 default TemplatePath -> WinBuild2025; -AllTemplates switch added.
H8: Setup-Host.ps1 adds StrictHostKeyChecking=accept-new and Step 8 to replicate SSH config
    to LocalSystem profile for act_runner service account.
H11: runner/config.yaml adds GITEA_CI_SCRIPT_ROOT env var; action.yml uses it in place of
     hardcoded N:\ path.
Also: Invoke-RemoteBuild.ps1 skips 7-Zip/Compress-Archive when artifact source dir does not
     exist (fixes burn-in smoke runs with exit-0 build command and no output).

scripts/Backup-CITemplate.ps1

@@ -11,13 +11,18 @@
 
     Restore procedure (after a bad refresh):
         Stop-Service act_runner
-        Remove-Item 'F:\CI\Templates\WinBuild' -Recurse -Force
-        Copy-Item 'F:\CI\Backups\Template_<stamp>' 'F:\CI\Templates\WinBuild' -Recurse
+        Remove-Item 'F:\CI\Templates\WinBuild2025' -Recurse -Force
+        Copy-Item 'F:\CI\Backups\Template_<stamp>' 'F:\CI\Templates\WinBuild2025' -Recurse
         Start-Service act_runner
 
 .PARAMETER TemplatePath
     Directory containing the template VM files (.vmx, .vmdk, snapshots).
-    Default: F:\CI\Templates\WinBuild
+    Default: F:\CI\Templates\WinBuild2025
+
+.PARAMETER AllTemplates
+    Back up every subdirectory under F:\CI\Templates\ in a single pass.
+    When set, TemplatePath is ignored. Backup folder names include the template
+    directory name: Template_<DirName>_<timestamp>.
 
 .PARAMETER BackupBaseDir
     Directory under which timestamped backup folders are created.
@@ -40,28 +45,28 @@
 
     # Keep 5 backups
     .\Backup-CITemplate.ps1 -KeepCount 5
+
+    # Back up all three templates
+    .\Backup-CITemplate.ps1 -AllTemplates
 #>
 [CmdletBinding(SupportsShouldProcess)]
 param(
-    [string] $TemplatePath  = 'F:\CI\Templates\WinBuild',
+    [string] $TemplatePath  = 'F:\CI\Templates\WinBuild2025',
 
     [string] $BackupBaseDir = 'F:\CI\Backups',
 
     [ValidateRange(1, 20)]
     [int] $KeepCount = 3,
 
-    [switch] $SkipRunnerStop
+    [switch] $SkipRunnerStop,
+
+    [switch] $AllTemplates
 )
 
 Set-StrictMode -Version Latest
 $ErrorActionPreference = 'Stop'
 
-if (-not (Test-Path $TemplatePath -PathType Container)) {
-    throw "Template directory not found: $TemplatePath"
-}
-
-$timestamp  = Get-Date -Format 'yyyyMMdd_HHmmss'
-$backupDest = Join-Path $BackupBaseDir "Template_$timestamp"
+$timestamp = Get-Date -Format 'yyyyMMdd_HHmmss'
 
 if (-not (Test-Path $BackupBaseDir)) {
     New-Item -ItemType Directory -Path $BackupBaseDir -Force | Out-Null
@@ -82,36 +87,54 @@ if (-not $SkipRunnerStop) {
 }
 
 try {
-    # ── Step 2: Copy template directory ───────────────────────────────────────
-    if ($PSCmdlet.ShouldProcess($TemplatePath, "Copy to $backupDest")) {
-        Write-Host "[Backup-CITemplate] Copying $TemplatePath -> $backupDest ..."
-        $sw = [System.Diagnostics.Stopwatch]::StartNew()
-        Copy-Item -Path $TemplatePath -Destination $backupDest -Recurse -Force
-        $sw.Stop()
-
-        # Size sum without Measure-Object.Sum (Set-StrictMode safe)
-        $backupFiles = Get-ChildItem $backupDest -Recurse -File -ErrorAction SilentlyContinue
-        $totalBytes  = [long]0
-        if ($backupFiles) { foreach ($f in $backupFiles) { $totalBytes += $f.Length } }
-        $sizeMB = [math]::Round($totalBytes / 1MB, 0)
-
-        Write-Host "[Backup-CITemplate] Backup complete: $backupDest ($sizeMB MB, $($sw.Elapsed.TotalSeconds.ToString('F0'))s)"
+    # ── Steps 2+3: Backup and prune one or all templates ──────────────────────
+    $templatesToBackup = @()
+    if ($AllTemplates) {
+        $templatesToBackup = @(Get-ChildItem 'F:\CI\Templates' -Directory -ErrorAction SilentlyContinue)
+        if ($templatesToBackup.Count -eq 0) { throw 'No template directories found under F:\CI\Templates' }
+    } else {
+        if (-not (Test-Path $TemplatePath -PathType Container)) {
+            throw "Template directory not found: $TemplatePath"
+        }
+        $templatesToBackup = @(Get-Item $TemplatePath)
     }
 
-    # ── Step 3: Prune old backups ──────────────────────────────────────────────
-    $existing = Get-ChildItem $BackupBaseDir -Directory -ErrorAction SilentlyContinue |
-        Where-Object { $_.Name -like 'Template_????????_??????' } |
-        Sort-Object LastWriteTime -Descending
+    foreach ($tmpl in $templatesToBackup) {
+        $nameTag    = if ($AllTemplates) { "$($tmpl.Name)_$timestamp" } else { $timestamp }
+        $backupDest = Join-Path $BackupBaseDir "Template_$nameTag"
 
-    if ($existing.Count -gt $KeepCount) {
-        $toRemove = $existing | Select-Object -Skip $KeepCount
-        foreach ($old in $toRemove) {
-            if ($PSCmdlet.ShouldProcess($old.FullName, 'Remove old backup')) {
-                Write-Host "[Backup-CITemplate] Pruning old backup: $($old.Name)"
-                Remove-Item $old.FullName -Recurse -Force
-            }
+        # ── Step 2: Copy template directory ───────────────────────────────────
+        if ($PSCmdlet.ShouldProcess($tmpl.FullName, "Copy to $backupDest")) {
+            Write-Host "[Backup-CITemplate] Copying $($tmpl.FullName) -> $backupDest ..."
+            $sw = [System.Diagnostics.Stopwatch]::StartNew()
+            Copy-Item -Path $tmpl.FullName -Destination $backupDest -Recurse -Force
+            $sw.Stop()
+
+            # Size sum without Measure-Object.Sum (Set-StrictMode safe)
+            $backupFiles = Get-ChildItem $backupDest -Recurse -File -ErrorAction SilentlyContinue
+            $totalBytes  = [long]0
+            if ($backupFiles) { foreach ($f in $backupFiles) { $totalBytes += $f.Length } }
+            $sizeMB = [math]::Round($totalBytes / 1MB, 0)
+
+            Write-Host "[Backup-CITemplate] Backup complete: $backupDest ($sizeMB MB, $($sw.Elapsed.TotalSeconds.ToString('F0'))s)"
+        }
+
+        # ── Step 3: Prune old backups for this template ────────────────────────
+        $prunePattern = if ($AllTemplates) { "Template_$($tmpl.Name)_????????_??????" } else { 'Template_????????_??????' }
+        $existing = Get-ChildItem $BackupBaseDir -Directory -ErrorAction SilentlyContinue |
+            Where-Object { $_.Name -like $prunePattern } |
+            Sort-Object LastWriteTime -Descending
+
+        if ($existing.Count -gt $KeepCount) {
+            $toRemove = $existing | Select-Object -Skip $KeepCount
+            foreach ($old in $toRemove) {
+                if ($PSCmdlet.ShouldProcess($old.FullName, 'Remove old backup')) {
+                    Write-Host "[Backup-CITemplate] Pruning old backup: $($old.Name)"
+                    Remove-Item $old.FullName -Recurse -Force
+                }
+            }
+            Write-Host "[Backup-CITemplate] Retained $KeepCount backup(s) for $($tmpl.Name)."
         }
-        Write-Host "[Backup-CITemplate] Retained $KeepCount backup(s)."
     }
 }
 finally {