feat(medium): sprint 3 Medium items 6 implementati, 6 confermati gia' presenti

codice:
- Watch-DiskSpace.ps1: Event Log source CI-DiskAlert -> CI-DiskSpaceAlert
  (allineato con task scheduler CI-DiskSpaceAlert)
- Watch-RunnerHealth.ps1: maintenance flag  salta restart se
  F:\CI\State\runner-maintenance.flag esiste
- Invoke-CIJob.ps1:
  - param WebhookUrl (default '') per alert webhook
  - sanity check TemplatePath: Write-Warning se non sotto F:\CI\Templates\
  - 90-min duration warning: Start-Job che posta [WARNING] dopo 5400s
  - finally: Remove-Job per cancellare il warn se build finisce prima

docs:
- BEST-PRACTICES.md sezione 11: VMware HGFS write semantics e cache-poisoning risk
- final-master-plan.md: marcati done  post-failure diagnostics, UseSharedCache,
  VMDK SHA256, SSH host-key, template-refresh runbook, 90-min warn, HGFS,
  Event Log names, TemplatePath sanity, maintenance flag, Setup-Host pass docs,
  emoji-free webhooks

docs/BEST-PRACTICES.md

@@ -392,3 +392,60 @@ if ($ExpectedSha256 -ne '') {
 Pin values must be updated each time a new installer version is adopted.
 Store the expected hash in the script's parameter default or in a companion
 `.sha256` sidecar file next to the cached installer in `F:\CI\ISO\`.
+
+---
+
+## 11. VMware Shared Folders (HGFS) — Write Semantics and Cache-Poisoning Risk
+
+### What UseSharedCache does
+
+When `Invoke-CIJob.ps1 -UseSharedCache` is set, the composite action enables
+VMware shared folders on the clone VM. The host-side folders (NuGet, pip) are
+mounted read-write inside the guest:
+
+| Host path              | Guest path (Windows)             | Guest path (Linux)        |
+| ---------------------- | -------------------------------- | ------------------------- |
+| `F:\CI\Cache\NuGet`    | `\\vmware-host\Shared Folders\ci-nuget-cache` | `/mnt/hgfs/ci-nuget-cache` |
+| `F:\CI\Cache\pip`      | `\\vmware-host\Shared Folders\ci-pip-cache`   | `/mnt/hgfs/ci-pip-cache`  |
+
+The guest build command reads from (and writes to) these folders directly. This
+avoids re-downloading packages on every build at the cost of shared state.
+
+### Write semantics — what you must understand
+
+**Writes from any guest are immediately visible on the host and in any other
+concurrently running guest that has the same shared folder mounted.**
+
+Consequences:
+1. A compromised or malicious build script can overwrite packages in the cache.
+   The next build that pulls from the same cache will use the poisoned package.
+2. Two concurrent builds writing to the same cache entry (e.g. the same pip
+   wheel filename) will corrupt each other. NuGet and pip use hash-verified
+   filenames so collisions are rare, but not impossible for mutable packages.
+3. Host-side antivirus exclusions for `F:\CI\Cache\` must be maintained if AV
+   is re-enabled (see section 2.1 Threat Model).
+
+### Safe-use rules
+
+- Use `UseSharedCache` **only** for trusted source code (internal team repos).
+  Do NOT enable for workflows that build third-party or unknown code.
+- Treat cache poisoning as a real threat if any of the following is true:
+  - The built repo has external contributors
+  - The repo has `git submodule` paths pointing to external forks
+  - The build script runs `pip install` / `nuget restore` with unpinned versions
+- When in doubt, omit `-UseSharedCache` (the default). Package downloads add
+  1-3 minutes per build but eliminate the shared-state risk entirely.
+
+### Cache invalidation
+
+There is no automatic cache invalidation. To force a clean state:
+```powershell
+# Remove all cached NuGet packages
+Remove-Item 'F:\CI\Cache\NuGet\*' -Recurse -Force
+
+# Remove all cached pip wheels
+Remove-Item 'F:\CI\Cache\pip\*' -Recurse -Force
+```
+
+After any template toolchain upgrade, clear the cache to avoid stale package
+metadata. The next build repopulates it.