feat(medium): sprint 3 Medium items 6 implementati, 6 confermati gia' presenti

codice:
- Watch-DiskSpace.ps1: Event Log source CI-DiskAlert -> CI-DiskSpaceAlert
  (allineato con task scheduler CI-DiskSpaceAlert)
- Watch-RunnerHealth.ps1: maintenance flag  salta restart se
  F:\CI\State\runner-maintenance.flag esiste
- Invoke-CIJob.ps1:
  - param WebhookUrl (default '') per alert webhook
  - sanity check TemplatePath: Write-Warning se non sotto F:\CI\Templates\
  - 90-min duration warning: Start-Job che posta [WARNING] dopo 5400s
  - finally: Remove-Job per cancellare il warn se build finisce prima

docs:
- BEST-PRACTICES.md sezione 11: VMware HGFS write semantics e cache-poisoning risk
- final-master-plan.md: marcati done  post-failure diagnostics, UseSharedCache,
  VMDK SHA256, SSH host-key, template-refresh runbook, 90-min warn, HGFS,
  Event Log names, TemplatePath sanity, maintenance flag, Setup-Host pass docs,
  emoji-free webhooks

scripts/Invoke-CIJob.ps1

@@ -155,7 +155,11 @@ param(
     # Extra environment variables injected into the guest VM before the build command (§6.5).
     # Keys must be valid environment variable names. Values must be plain strings.
     # Example: @{ SIGN_PASS = $env:SIGN_PASS_FROM_SECRET; GPG_KEY_ID = '0xABCD1234' }
-    [hashtable] $ExtraGuestEnv = @{}
+    [hashtable] $ExtraGuestEnv = @{},
+
+    # Optional webhook URL (Discord/Gitea). When set, a background job fires a
+    # [WARNING] once the job has been running for 90 minutes.
+    [string] $WebhookUrl = ''
 )
 
 Set-StrictMode -Version Latest
@@ -176,6 +180,10 @@ if (-not (Test-Path $TemplatePath -PathType Leaf)) {
     Write-Error "Template VMX not found: $TemplatePath"
     exit 1
 }
+# Sanity check: warn if template is outside the expected CI tree
+if ($TemplatePath -notlike 'F:\CI\Templates\*') {
+    Write-Warning "[Invoke-CIJob] TemplatePath '$TemplatePath' is not under F:\CI\Templates\. Ensure this is intentional."
+}
 if (-not (Test-Path $VmrunPath -PathType Leaf)) {
     Write-Error "vmrun.exe not found: $VmrunPath"
     exit 1
@@ -274,9 +282,24 @@ Write-JobEvent -Phase 'job' -Status 'start' -Data @{
     snapshot = $SnapshotName
 }
 
-$exitCode = 0
+$exitCode        = 0
+$durationWarnJob = $null
 
 try {
+    # ── 90-minute duration warning (fires once via background job) ───────────────
+    if ($WebhookUrl -ne '') {
+        $warnMsg  = "[WARNING] CI Job duration -- Job $JobId has been running for 90 minutes. Check $RepoUrl or kill the job if stuck."
+        $warnBody = (@{ content = $warnMsg } | ConvertTo-Json -Compress)
+        $durationWarnJob = Start-Job -ScriptBlock {
+            param($url, $body)
+            Start-Sleep -Seconds 5400   # 90 minutes
+            try {
+                Invoke-RestMethod -Uri $url -Method Post -Body $body `
+                    -ContentType 'application/json' -TimeoutSec 10
+            } catch { }
+        } -ArgumentList $WebhookUrl, $warnBody
+    }
+
     # ── Phase 1: Clone repo (HOST or GUEST) ───────────────────────────────
     if ($UseGitClone) {
         # §3.3: Clone in guest VM instead of host. Skip host clone phase.
@@ -606,6 +629,12 @@ finally {
         Remove-Item $hostCloneDir -Recurse -Force -ErrorAction SilentlyContinue
     }
 
+    # ── Cancel 90-minute warning job (build finished before it fired) ──────────
+    if ($null -ne $durationWarnJob) {
+        Remove-Job -Job $durationWarnJob -Force -ErrorAction SilentlyContinue
+        $durationWarnJob = $null
+    }
+
     # ── Stop transcript ───────────────────────────────────────────────────
     if ($transcriptStarted) {
         try { Stop-Transcript -ErrorAction SilentlyContinue } catch { Write-Debug "[Invoke-CIJob] Stop-Transcript ignored: $_" }