feat(low): sprint 4 Low items tutti 5 completati

codice:
- template/Validate-SetupState.ps1: docblock HTTP/Basic -> HTTPS/Basic, port 5986
- scripts/Validate-HostState.ps1 (nuovo): check ACL SSH key ci_linux, Credential Manager
  target BuildVMGuest, struttura dir F:\CI\, vmrun.exe raggiungibile

docs:
- docs/TEST-PLAN-v1.3-to-HEAD.md sezione 3.6: campi JSONL corretti (cloneSec/startSec/
  ipSec/winrmSec/destroySec/totalBootSec) per riflettere output reale di Measure-CIBenchmark.ps1
- docs/CI-FLOW.md tabella failure: 'partial artifacts' -> Get-GuestDiagnostics a diagnostics/
- docs/CHANGELOG.md (nuovo): log reverse-cronologico di tutti gli sprint completati
- plans/final-master-plan.md: tutti i Low marcati done

docs/CI-FLOW.md

@@ -270,7 +270,7 @@ automatically via `vmrun getGuestIPAddress` — no static assignment required.
 | -------------------------------------- | ------------------------------------------------------------------------------------------------------------------- |
 | VM clone fails                         | `Invoke-CIJob.ps1` throws; no VM to destroy; job fails immediately                                                  |
 | VM never reaches ready state (timeout) | `Wait-VMReady.ps1` throws; `finally` destroys the (running) VM                                                      |
-| Build fails inside VM                  | `Invoke-RemoteBuild.ps1` throws; `finally` collects partial artifacts (if any), destroys VM                         |
+| Build fails inside VM                  | `Invoke-RemoteBuild.ps1` throws; `finally` runs `Get-GuestDiagnostics` (best-effort, to `F:\CI\Artifacts\<jobId>\diagnostics\`), destroys VM |
 | Artifact collection fails              | Job marked failed; VM is still destroyed in `finally`                                                               |
 | Host machine loses power mid-job       | `act_runner` resumes on reboot, marks in-flight job as failed; orphan VMs must be cleaned up manually (see TODO.md) |