chore: initial commit local CI/CD system (e2e verified, production-ready)

Sistema CI locale basato su VMware Workstation + Gitea Actions + act_runner.
Testato e2e con nsis-plugin-nsinnounp (MSBuild + Python, 4 configurazioni parallele).

- scripts/: Invoke-CIJob, Invoke-RemoteBuild, New/Remove-BuildVM, Wait-VMReady, Get-BuildArtifacts
- runner/: act_runner config (windows-build label, capacity 4)
- gitea/workflows/: build-nsis.yml (template per progetti MSBuild/Python)
- template/: script di provisioning template VM (VS BuildTools 2026, .NET SDK 10, Python 3.13)
- docs/: ARCHITECTURE, CI-FLOW, OPTIMIZATION, BEST-PRACTICES, Setup-GiteaSSH

Verificato: e2e-009 SUCCESS in 02:09, cleanup automatico VM confermato.

runner/config.yaml

@@ -0,0 +1,82 @@
+# act_runner configuration for Local CI/CD System
+# Documentation: https://gitea.com/gitea/act_runner
+
+log:
+  # Log level: trace, debug, info, warn, error, fatal
+  level: info
+  # Log format: text or json
+  format: text
+
+runner:
+  # Path to the runner state file (stores runner registration info)
+  file: .runner
+
+  # Maximum number of concurrent jobs this runner will accept.
+  # Each job spawns one ephemeral VM. Budget: 64GB RAM / ~8GB per VM = 8 max.
+  # Set conservatively to 4 until you benchmark actual memory usage.
+  capacity: 4
+
+  # Environment variables injected into every job's environment.
+  envs:
+    # Path to the template VM - update after provisioning the template
+    GITEA_CI_TEMPLATE_PATH: "F:\\CI\\Templates\\WinBuild\\CI-WinBuild.vmx"
+    # Base directory where ephemeral clone VMs are created
+    GITEA_CI_CLONE_BASE_DIR: "F:\\CI\\BuildVMs"
+    # Base directory for collected build artifacts
+    GITEA_CI_ARTIFACT_DIR: "F:\\CI\\Artifacts"
+    # Windows Credential Manager target name for guest VM credentials
+    GITEA_CI_GUEST_CRED_TARGET: "BuildVMGuest"
+
+  # Optional: load additional env vars from a file (one KEY=VALUE per line)
+  # env_file: "F:\\CI\\runner.env"
+
+  # Maximum duration for a single job before it is killed.
+  # Set this higher than your longest expected build.
+  timeout: 2h
+
+  # Labels this runner advertises to Gitea.
+  # Workflows using "runs-on: windows-build" will be routed to this runner.
+  labels:
+    - "windows-build:host"
+    - "dotnet:host"
+    - "msbuild:host"
+
+  # Uncomment to ignore specific errors
+  # insecure: false
+
+cache:
+  # Enable the built-in cache server (used by actions/cache steps)
+  enabled: true
+  # Cache storage directory on the host
+  dir: "F:\\CI\\Cache"
+  # External cache server - leave empty to use built-in
+  host: ""
+  port: 0
+
+container:
+  # IMPORTANT: must be false on this runner.
+  # All builds run in VMware VMs, not Docker containers.
+  enabled: false
+
+  # These settings are ignored when container.enabled is false,
+  # but kept for documentation purposes.
+  # network: ""
+  # privileged: false
+  # options: ""
+  # workdir_parent: ""
+
+host:
+  # Working directory on the host for act_runner's own workspace files.
+  # Each job gets a subdirectory here for checkout and step scripts.
+  workdir_parent: "F:\\CI\\RunnerWork"
+
+artifact:
+  # Gitea artifact proxy settings
+  # Artifacts uploaded by steps (actions/upload-artifact) are stored via Gitea.
+  # The runner itself handles local artifact paths via Invoke-CIJob.ps1.
+  enabled: true
+  dir: "F:\\CI\\Artifacts"
+  # Retention in days for artifacts stored by act_runner itself
+  # (distinct from the Gitea server's own artifact retention setting)
+  retention:
+    days: 7