feat(sprint2): §2.1/2.2/2.3/2.5 — IP lock/lease, scheduled tasks, retention, versioned snapshot

§2.1 — IP race with capacity>1 (Invoke-CIJob.ps1)
  Phases 2-3b (clone+start+IP) now run inside a file-based exclusive mutex
  (F:\CI\State\vm-start.lock via FileShare.None). Only one job at a time is
  in the VM-start phase, preventing concurrent vmrun starts from racing for
  the same DHCP lease. After IP is confirmed unique it is written to an IP
  lease file (F:\CI\State\ip-leases\<IP>.lease). Lock is released immediately
  so build phases run fully in parallel. Lease released in finally block.
  Collision detection: if a lease file already exists for the detected IP,
  the job fails fast with a clear error rather than silently sharing a WinRM target.

§2.5 — Versioned snapshot (Invoke-CIJob.ps1 + runner/config.yaml)
  $SnapshotName now defaults to GITEA_CI_SNAPSHOT_NAME env var, falling back
  to 'BaseClean'. config.yaml documents the commented-out variable for snapshot
  refresh workflow (BaseClean_<yyyyMMdd> naming convention).

§2.3 — Artifact/log retention (scripts/Invoke-RetentionPolicy.ps1)
  Purges per-job subdirs under F:\CI\Artifacts and F:\CI\Logs older than
  RetentionDays (default 30). Switches to AggressiveRetentionDays (default 7)
  when F: free space drops below MinFreeGB (default 50 GB). Also removes stale
  IP lease files older than 12 hours (defensive cleanup for crashed jobs).
  SupportsShouldProcess (-WhatIf) for dry-run.

§2.2 — Scheduled task registration (scripts/Register-CIScheduledTasks.ps1)
  Registers two tasks under \CI\ task folder as SYSTEM/HighestPrivilege:
    CI-CleanupOrphans  — every 6h + AtStartup, -MaxAgeHours 4
    CI-RetentionPolicy — daily 03:00 (+30min random) + AtStartup (+15min random)
  Idempotent (-Force), SupportsShouldProcess (-WhatIf), validates script paths.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

TODO.md

@@ -18,7 +18,7 @@
 ---
 ## Summary
 
-_Last updated: 2026-05-10 (post §7.4 e2e + tag v1.2)_
+_Last updated: 2026-05-10 (post Sprint 2 operatività)_
 
 **Stato generale**: infrastruttura base e refactor Deploy↔Setup (§7) completi. Sicurezza sprint 1 in corso (HTTPS/5986 done, IP regex done, hash pinning struttura done — valori da riempire). Backlog operatività/perf/qualità intatto.
 
@@ -30,7 +30,7 @@ _Last updated: 2026-05-10 (post §7.4 e2e + tag v1.2)_
 | Runner Configuration            |  all |    0 | `config.yaml`, capacity 4, `BuildVMGuest`                         |
 | Gitea Workflow Integration      |    4 |    1 | manca solo §P3 generalizzazione workflow                          |
 | §1 Sicurezza & hardening        |    2 |    6 | 1.1, 1.4 done; 1.2/1.3 parzialmente; 1.5/1.6/1.7/1.8 da fare      |
-| §2 Affidabilità & resilienza    |    0 |    7 | tutto backlog (race IP, cleanup schedulato, snapshot versionato…) |
+| §2 Affidabilità & resilienza    |    4 |    3 | 2.1/2.2/2.3/2.5 done; 2.4/2.6/2.7 backlog                        |
 | §3 Performance & throughput     |    0 |    6 | nessuna ottimizzazione applicata; baseline §3.6 prerequisito      |
 | §4 Osservabilità & manutenzione |    0 |    5 | log JSONL, metriche, runbook tutti aperti                         |
 | §5 Qualità codice & test        |    0 |    5 | Pester, modulo `_Common.psm1`, regole PSScriptAnalyzer custom     |
@@ -266,7 +266,7 @@ senza tracciamento.
 
 ## 2. Affidabilità & resilienza
 
-### 2.1 [P0] [ ] Race su IP allocation con `capacity: 4`
+### 2.1 [P0] [x] Race su IP allocation — COMPLETATO 2026-05-10
 File: [runner/config.yaml:17](runner/config.yaml), [scripts/Invoke-CIJob.ps1:244-253](scripts/Invoke-CIJob.ps1).
 
 **Stato osservato**: race non riprodotta in e2e-008/009 (un job alla volta). `capacity: 4`
@@ -287,8 +287,8 @@ rilevata in fase di Wait-VMReady — apparirà come "WinRM risponde ma è la VM
 
 L'opzione A è la più portabile e si integra con il pre-warm pool (§3.4).
 
-### 2.2 [P1] [ ] Cleanup orfani schedulato
-File: [scripts/Cleanup-OrphanedBuildVMs.ps1](scripts/Cleanup-OrphanedBuildVMs.ps1) — script pronto, manca lo scheduling.
+### 2.2 [P1] [x] Cleanup orfani schedulato — COMPLETATO 2026-05-10
+File: [scripts/Cleanup-OrphanedBuildVMs.ps1](scripts/Cleanup-OrphanedBuildVMs.ps1) — script pronto, scheduling registrato da [scripts/Register-CIScheduledTasks.ps1](scripts/Register-CIScheduledTasks.ps1).
 
 Estendere `Setup-Host.ps1` per registrare un Task Scheduler:
 ```powershell
@@ -301,8 +301,8 @@ Register-ScheduledTask -TaskName 'CI-CleanupOrphans' -Action $action -Trigger $t
 Aggiungere anche un trigger `AtStartup` per gestire crash dell'host.
 Suggerito: ogni 6 ore, `-MaxAgeHours 4`.
 
-### 2.3 [P1] [ ] Retention artifact + log automatica
-File: [docs/OPTIMIZATION.md:160-181](docs/OPTIMIZATION.md) — la logica c'è solo come snippet, non eseguita.
+### 2.3 [P1] [x] Retention artifact + log automatica — COMPLETATO 2026-05-10
+File: [scripts/Invoke-RetentionPolicy.ps1](scripts/Invoke-RetentionPolicy.ps1) — script creato; scheduling via [scripts/Register-CIScheduledTasks.ps1](scripts/Register-CIScheduledTasks.ps1).
 
 Stessa pattern di §2.2 ma su `F:\CI\Artifacts` con `-AddDays(-30)` e su `F:\CI\Logs` con la
 finestra già configurata in `Invoke-CIJob.ps1`. Aggiungere
@@ -315,7 +315,7 @@ File: [scripts/Remove-BuildVM.ps1:28](scripts/Remove-BuildVM.ps1).
 Aggiungere `[CmdletBinding(SupportsShouldProcess)]` come fatto in `Cleanup-OrphanedBuildVMs.ps1`.
 Permette debug e dry-run senza forkare un secondo script.
 
-### 2.5 [P1] [ ] Snapshot versionato `BaseClean_<yyyyMMdd>`
+### 2.5 [P1] [x] Snapshot versionato `BaseClean_<yyyyMMdd>` — COMPLETATO 2026-05-10
 File: [docs/BEST-PRACTICES.md:142-145](docs/BEST-PRACTICES.md), [scripts/Invoke-CIJob.ps1:100](scripts/Invoke-CIJob.ps1).
 
 **Motivazione**: quando si refresha il template (KMS lease semestrale, update toolchain), il