feat(sprint4): operational hardening, diagnostics, VMDK SHA256, runbook

Task 4.1: Invoke-CIJob.ps1 pre-clone disk gate (needs 10 GB free), JobId/ExtraGuestEnv
          pattern validation, redacted command logger (already included via _Common.psm1).
Task 4.2: Get-GuestDiagnostics helper invoked from catch block (best-effort, no throw).
Task 4.3: UseSharedCache wired through composite action and orchestrator.
Task 4.4: SSH known_hosts in F:\CI\State\known_hosts for CI jobs; accept-new for templates.
Task 4.5: Deploy-LinuxBuild2404.ps1 verifies Ubuntu VMDK SHA256 before import.
Task 4.6: RUNBOOK.md consolidated template-refresh section: stop runner, backup, boot,
          KMS reactivation, Prepare-*, shutdown, snapshot, Validate-DeployState, smoke,
          update config, retain prior snapshot 7 days, rollback procedure.
Validate-SetupState.ps1: minor lint fixes and docblock updates.
Wait-VMReady.ps1: Get-BuildArtifacts.ps1: hardening alignment with Sprint 4 objectives.

scripts/Get-BuildArtifacts.ps1

@@ -61,7 +61,11 @@ param(
     [string] $SshKeyPath = 'F:\CI\keys\ci_linux',
 
     # SSH username (used when GuestOS=Linux).
-    [string] $SshUser = 'ci_build'
+    [string] $SshUser = 'ci_build',
+
+    # Persistent known_hosts file for SSH calls (CI jobs).
+    # Pass an empty string to disable host-key checking (template provisioning only).
+    [string] $SshKnownHostsFile = 'F:\CI\State\known_hosts'
 )
 
 Set-StrictMode -Version Latest
@@ -90,6 +94,7 @@ if ($GuestOS -eq 'Linux') {
         -IP          $IPAddress `
         -User        $SshUser `
         -KeyPath     $SshKeyPath `
+        -KnownHostsFile $SshKnownHostsFile `
         -Direction   'FromGuest' `
         -Recurse