fix(winrm): default to NTLM for local-account build VMs

pypsrp defaults to auth='negotiate', which attempts Kerberos with no
domain and fails under SSPI with SEC_E_UNKNOWN_CREDENTIALS for the
workgroup ci_build account. Default to 'ntlm' (configurable). The
guest username must be host-qualified (WINBUILD-2025\ci_build) and
stored that way in the credential vault.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/ci_orchestrator/transport/winrm.py

@@ -59,6 +59,7 @@ class WinRmTransport:
         ssl: bool = True,
         cert_validation: bool = False,
         connection_timeout: int = 30,
+        auth: str = "ntlm",
     ) -> None:
         self._host = host
         self._username = username
@@ -67,6 +68,12 @@ class WinRmTransport:
         self._ssl = ssl
         self._cert_validation = cert_validation
         self._connection_timeout = connection_timeout
+        # Build VMs use local (workgroup) accounts. pypsrp defaults to
+        # 'negotiate', which tries Kerberos with no domain and fails under
+        # SSPI with SEC_E_UNKNOWN_CREDENTIALS. NTLM is required for local
+        # accounts. The guest username must also be host-qualified
+        # (WINBUILD-2025\ci_build), stored that way in the credential vault.
+        self._auth = auth
         self._client: Client | None = None
 
     # ----------------------------------------------------------- connection
@@ -86,6 +93,7 @@ class WinRmTransport:
                 password=self._password,
                 port=self._port,
                 ssl=self._ssl,
+                auth=self._auth,
                 cert_validation=self._cert_validation,
                 connection_timeout=self._connection_timeout,
             )