feat(template): §6.6 Tier-2 toolchain PS7/NSIS/CMake/Node.js/WiX/gh CLI/Sysinternals/vcpkg

Step 12 in Setup-WinBuild2025.ps1 installs all 8 Tier-2 tools:
  - PowerShell 7.4.7 LTS (pwsh.exe)
  - NSIS 3.10 (makensis.exe)
  - CMake 3.31.6 (cmake.exe)
  - Node.js 22.14.0 LTS (node.exe + npm)
  - WiX 4.0.5 via dotnet tool (wix.exe, C:\BuildTools\Wix\)
  - GitHub CLI 2.67.0 (gh.exe)
  - Sysinternals Suite (C:\BuildTools\Sysinternals\, extracted via 7-Zip)
  - vcpkg HEAD shallow clone + bootstrap (C:\BuildTools\vcpkg\)

All tools added to Machine PATH; idempotent (binary-presence check).
Hash entries in \ ready for SHA256 pinning.
knownTempFiles extended; Final gate Assert-Step added for all 8 binaries.

Prepare-WinBuild2025.ps1: 7 new params + pass-through to Setup.
Validate-SetupState.ps1: Tier-2 checks in both main + re-run scriptblocks.
TODO.md: §6.6 [~] -> [x], Sprint 11 summary.

template/Prepare-WinBuild2025.ps1

@@ -132,6 +132,15 @@ param(
 
     [string] $DotNetSdkVersion = '10.0',
 
+    # Tier-2 Toolchain version pins — forwarded as-is to Setup-WinBuild2025.ps1
+    [string] $Pwsh7Version   = '7.4.7',
+    [string] $NSISVersion    = '3.10',
+    [string] $CMakeVersion   = '3.31.6',
+    [string] $NodeJSVersion  = '22.14.0',
+    [string] $WiXVersion     = '4.0.5',
+    [string] $GhCliVersion   = '2.67.0',
+    [string] $VcpkgRef       = '',
+
     [switch] $SkipWindowsUpdate,
 
     # Skip disk cleanup inside the VM (cleanmgr + DISM + cache clear) — speeds up re-runs
@@ -367,6 +376,13 @@ try {
         BuildUsername      = $BuildUsername
         DotNetSdkVersion   = $DotNetSdkVersion
         AdminPassword      = $AdminPassword
+        Pwsh7Version       = $Pwsh7Version
+        NSISVersion        = $NSISVersion
+        CMakeVersion       = $CMakeVersion
+        NodeJSVersion      = $NodeJSVersion
+        WiXVersion         = $WiXVersion
+        GhCliVersion       = $GhCliVersion
+        VcpkgRef           = $VcpkgRef
     }
     if ($SkipWindowsUpdate) { $setupArgs['SkipWindowsUpdate'] = $true }
     if ($SkipCleanup)       { $setupArgs['SkipCleanup']       = $true }