feat(sprint2): fix critical and high-priority bugs

C1: composite action selects Linux/Windows template from GITEA_CI_LINUX_TEMPLATE_PATH
    based on resolved guest OS; build-nsis.yml adds belt-and-suspenders guest-os param.
C2: redact ExtraGuestEnv secrets in Invoke-RemoteBuild.ps1 (envPrefix never logged).
H2: composite action outputs block corrected; duplicate artifact-name input removed.
H3: Linux Mode 2 PAT now uses http.extraHeader (mirrors Windows branch, drops GIT_CLONE_URL).
H6: Setup-Host.ps1 directory array updated to canonical layout (adds State, ip-leases, keys,
    Cache\pip, WinBuild2025/2022/LinuxBuild2404; removes obsolete WinBuild).
H7: Backup-CITemplate.ps1 default TemplatePath -> WinBuild2025; -AllTemplates switch added.
H8: Setup-Host.ps1 adds StrictHostKeyChecking=accept-new and Step 8 to replicate SSH config
    to LocalSystem profile for act_runner service account.
H11: runner/config.yaml adds GITEA_CI_SCRIPT_ROOT env var; action.yml uses it in place of
     hardcoded N:\ path.
Also: Invoke-RemoteBuild.ps1 skips 7-Zip/Compress-Archive when artifact source dir does not
     exist (fixes burn-in smoke runs with exit-0 build command and no output).

scripts/Invoke-RetentionPolicy.ps1

@@ -124,6 +124,20 @@ if (Test-Path $leasesDir) {
     }
 }
 
+# ── Stale vm-start.lock cleanup ─────────────────────────────────────────────
+# The lock is released by Invoke-CIJob.ps1 normally. On host crash it persists;
+# the OS-level lock is gone after reboot but the file blocks subsequent IP-acquire
+# retries for 10 minutes and confuses operators. Remove if older than 30 minutes.
+$lockFile  = 'F:\CI\State\vm-start.lock'
+$lockCutoff = (Get-Date).AddMinutes(-30)
+if ((Test-Path $lockFile) -and (Get-Item $lockFile).LastWriteTime -lt $lockCutoff) {
+    if ($PSCmdlet.ShouldProcess($lockFile, 'Remove stale vm-start.lock')) {
+        $lockAgeMin = [int]((Get-Date) - (Get-Item $lockFile).LastWriteTime).TotalMinutes
+        Remove-Item $lockFile -Force -ErrorAction SilentlyContinue
+        Write-Host "[RetentionPolicy] Removed stale vm-start.lock (age: ${lockAgeMin} min)"
+    }
+}
+
 # ── Summary ───────────────────────────────────────────────────────────────────
 $freeGBAfter = if ($drive) { [math]::Round((Get-PSDrive -Name $DriveLetter -ErrorAction SilentlyContinue).Free / 1GB, 1) } else { $freeGB }
 $delta       = [math]::Round($freeGBAfter - $freeGB, 1)