feat(a3): port build pipeline (vm new, build run, artifacts collect)

Implements Phase A3 of plans/implementation-plan-A-B.md:

- commands/vm.py: vm new (replaces New-BuildVM.ps1)

- commands/build.py: build run (replaces Invoke-RemoteBuild.ps1) with WinRM/SSH dispatch and stdout streaming for act_runner

- commands/artifacts.py: artifacts collect (replaces Get-BuildArtifacts.ps1) using transport.fetch()

- 3 PS scripts reduced to shims preserving \0

- Pester tests/{New-BuildVM,Wait-VMReady,Remove-BuildVM}.Tests.ps1 removed; equivalent cases covered in pytest

- Phase C hook: build/artifacts accept opaque VmHandle/vmx; no Windows path assumptions

Tests: 91 pytest, ruff clean, mypy --strict clean, coverage 78.27% (>=70 gate).

Master checklist + step A3 attivita + 'definizione di fatto' updated; A3-closeout.md added.

plans/A3-closeout.md

@@ -0,0 +1,31 @@
+# A3 — Closeout
+
+Fase A3 di `plans/implementation-plan-A-B.md`: pipeline core (clone → build → collect) in Python.
+Branch: `feature/python-rewrite-phase-a`.
+
+## Stato attuale
+
+- [x] `commands/vm.py` esteso con `vm new` (sostituisce `New-BuildVM.ps1`)
+- [x] `commands/build.py` con `build run` (sostituisce `Invoke-RemoteBuild.ps1`)
+- [x] `commands/artifacts.py` con `artifacts collect` (sostituisce `Get-BuildArtifacts.ps1`)
+- [x] Tutti i 3 `.ps1` ridotti a shim verso la CLI Python
+- [x] Pester `tests/{New-BuildVM,Wait-VMReady,Remove-BuildVM}.Tests.ps1` rimossi (casi negativi coperti dai pytest equivalenti)
+- [x] 91 pytest, ruff/mypy --strict clean, coverage 78.27%
+- [x] Hook Fase C: `build run` + `artifacts collect` accettano `VmHandle`/`vmx` opaco; nessuna assunzione path Windows
+- [ ] Smoke end-to-end manuale: clone WinBuild2025 → build script trivial → collect artifact ZIP
+- [ ] Smoke end-to-end Linux equivalente
+
+## Definizione di "fatto" A3
+
+| Criterio | Stato |
+| --- | --- |
+| Pipeline build completa via Python CLI | ✅ |
+| Shim PS preservano API per caller esistenti | ✅ |
+| Smoke build PASS contro VM reale Windows e Linux | ⏳ validazione hardware |
+| Pester `New-BuildVM.Tests.ps1` rimosso e sostituito | ✅ |
+
+## Cosa resta a carico utente
+
+1. Smoke manuale end-to-end Windows: `python -m ci_orchestrator vm new ... && build run ... && artifacts collect ...`
+2. Stesso smoke su Linux template
+3. Verificare che `Test-NsinnounpBuild.ps1` continui a passare invocando gli shim