feat(sprint4): operational hardening, diagnostics, VMDK SHA256, runbook

Task 4.1: Invoke-CIJob.ps1 pre-clone disk gate (needs 10 GB free), JobId/ExtraGuestEnv
          pattern validation, redacted command logger (already included via _Common.psm1).
Task 4.2: Get-GuestDiagnostics helper invoked from catch block (best-effort, no throw).
Task 4.3: UseSharedCache wired through composite action and orchestrator.
Task 4.4: SSH known_hosts in F:\CI\State\known_hosts for CI jobs; accept-new for templates.
Task 4.5: Deploy-LinuxBuild2404.ps1 verifies Ubuntu VMDK SHA256 before import.
Task 4.6: RUNBOOK.md consolidated template-refresh section: stop runner, backup, boot,
          KMS reactivation, Prepare-*, shutdown, snapshot, Validate-DeployState, smoke,
          update config, retain prior snapshot 7 days, rollback procedure.
Validate-SetupState.ps1: minor lint fixes and docblock updates.
Wait-VMReady.ps1: Get-BuildArtifacts.ps1: hardening alignment with Sprint 4 objectives.

template/Deploy-LinuxBuild2404.ps1

@@ -79,6 +79,11 @@
 .PARAMETER VmdkCachePath
     Local cache path for the downloaded VMDK. Reused across runs.
 
+.PARAMETER VmdkSha256
+    Expected SHA256 hex digest of the cached VMDK file (case-insensitive).
+    When non-empty the script throws if the computed hash does not match.
+    Leave empty to skip hash verification (useful during development).
+
 .PARAMETER SeedIsoPath
     Path for the cloud-init seed ISO. Default: <VMDir>\cloud-init-seed.iso.
 
@@ -136,6 +141,9 @@ param(
     [string] $SshKeyPath            = 'F:\CI\keys\ci_linux',
     [string] $VmdkUrl               = 'https://cloud-images.ubuntu.com/noble/current/noble-server-cloudimg-amd64.vmdk',
     [string] $VmdkCachePath         = 'F:\CI\ISO\noble-server-cloudimg-amd64.vmdk',
+    # Expected SHA256 of the downloaded VMDK (hex, case-insensitive).
+    # Leave empty to skip hash verification (not recommended for production).
+    [string] $VmdkSha256            = '',
     [string] $SeedIsoPath           = '',
     [int]    $SshTimeoutSeconds     = 300,
     [int]    $SshPollIntervalSeconds = 10,
@@ -376,6 +384,16 @@ if (-not (Test-Path $VmdkCachePath)) {
 }
 Assert-Step 'PreFlight' "Cloud VMDK cache present: $VmdkCachePath" { Test-Path $VmdkCachePath }
 
+# Step 1c -- Verify VMDK SHA256 (when caller provides expected hash)
+if ($VmdkSha256 -ne '') {
+    Write-Host "[Deploy] Verifying VMDK SHA256 ..."
+    $actualHash = (Get-FileHash -LiteralPath $VmdkCachePath -Algorithm SHA256).Hash
+    if ($actualHash -ne $VmdkSha256.ToUpper()) {
+        throw "[Deploy] VMDK SHA256 mismatch!`n  Expected: $($VmdkSha256.ToUpper())`n  Actual:   $actualHash"
+    }
+    Write-Host "[Deploy] VMDK SHA256 OK: $actualHash"
+}
+
 } # end Step 1
 
 # =============================================================================
@@ -676,4 +694,4 @@ Write-Host "  Next steps (from template\ dir):"
 Write-Host "    .\Prepare-LinuxBuild2404.ps1 -VMXPath '$VMXPath' -VMIPAddress $guestIP"
 Write-Host ""
 Write-Host "  VM is powered on. cloud-init provisioning complete." -ForegroundColor Green
-
+