feat(sprint4): operational hardening, diagnostics, VMDK SHA256, runbook

Task 4.1: Invoke-CIJob.ps1 pre-clone disk gate (needs 10 GB free), JobId/ExtraGuestEnv
          pattern validation, redacted command logger (already included via _Common.psm1).
Task 4.2: Get-GuestDiagnostics helper invoked from catch block (best-effort, no throw).
Task 4.3: UseSharedCache wired through composite action and orchestrator.
Task 4.4: SSH known_hosts in F:\CI\State\known_hosts for CI jobs; accept-new for templates.
Task 4.5: Deploy-LinuxBuild2404.ps1 verifies Ubuntu VMDK SHA256 before import.
Task 4.6: RUNBOOK.md consolidated template-refresh section: stop runner, backup, boot,
          KMS reactivation, Prepare-*, shutdown, snapshot, Validate-DeployState, smoke,
          update config, retain prior snapshot 7 days, rollback procedure.
Validate-SetupState.ps1: minor lint fixes and docblock updates.
Wait-VMReady.ps1: Get-BuildArtifacts.ps1: hardening alignment with Sprint 4 objectives.

scripts/Wait-VMReady.ps1

@@ -38,6 +38,13 @@
     WinRM (default): checks ICMP ping + TCP 5986 (Windows VMs).
     SSH: checks TCP 22 + ssh echo (Linux VMs).
 
+.PARAMETER Credential
+    Optional PSCredential for Windows VMs. When supplied, Wait-VMReady performs
+    a real Invoke-Command { 'ready' } probe after TCP 5986 succeeds, confirming
+    that WinRM authentication (not just port) is working. Useful to detect the
+    window where the WinRM listener is up but the LocalSystem session is not yet
+    accepting logins. When omitted the TCP check alone is used (existing behaviour).
+
 .PARAMETER SshKeyPath
     Path to the SSH private key for key-based auth when Transport=SSH.
     Default: F:\CI\keys\ci_linux
@@ -82,7 +89,11 @@ param(
     [string] $SshKeyPath = 'F:\CI\keys\ci_linux',
 
     # SSH username (used when Transport=SSH).
-    [string] $SshUser = 'ci_build'
+    [string] $SshUser = 'ci_build',
+
+    # Optional credential for WinRM authentication probe (Transport=WinRM).
+    # When supplied, performs Invoke-Command { 'ready' } after TCP 5986 succeeds.
+    [PSCredential] $Credential = $null
 )
 
 Set-StrictMode -Version Latest
@@ -203,6 +214,24 @@ while ((Get-Date) -lt $deadline) {
                        -InformationLevel Quiet -WarningAction SilentlyContinue `
                        -ErrorAction SilentlyContinue
         if ($winrmUp) {
+            # Optional auth probe — ensures WinRM login is functional, not just TCP open
+            if ($null -ne $Credential) {
+                try {
+                    $so = New-PSSessionOption -SkipCACheck -SkipCNCheck -SkipRevocationCheck
+                    $null = Invoke-Command -ComputerName $IPAddress -Credential $Credential `
+                        -Authentication Basic -UseSSL -Port 5986 -SessionOption $so `
+                        -ScriptBlock { 'ready' } -ErrorAction Stop
+                    Write-Host "[Wait-VMReady] WinRM auth confirmed for $IPAddress."
+                } catch {
+                    $phase = 'winrm-auth'
+                    if ($lastPhase -ne $phase) {
+                        Write-Host "[Wait-VMReady] Phase 3/3: WinRM port open, waiting for auth at $IPAddress..."
+                        $lastPhase = $phase
+                    }
+                    Start-Sleep -Seconds $PollIntervalSeconds
+                    continue
+                }
+            }
             Write-Host "[Wait-VMReady] VM ready after ~$([int]($attempt * $PollIntervalSeconds))s (attempt $attempt)."
             return
         }