fix: apply all FIX-TODO items (P0/P1/P2)

P0 bugs:
- Invoke-CIJob.ps1: skip --depth 1 when $Commit specified (shallow clone
  + checkout specific commit was silently failing)
- Get-BuildArtifacts.ps1: check .Length -eq 0 not rounded sizeKB (false
  fail on artifacts smaller than 50 bytes)
- build-nsis.yml: upgrade upload-artifact v3 -> v4 (v3 deprecated)

P0 security:
- Remove hardcoded default password CIBuild!ChangeMe2026 from all scripts,
  README, TODO; prompt Read-Host -AsSecureString at runtime instead
- Setup-TemplateVM.ps1: replace `net user $u $p /add` (password in argv /
  audit log 4688) with New-LocalUser + local ConvertTo-SecureString
- Prepare-TemplateSetup.ps1: save and restore WSMan AllowUnencrypted +
  TrustedHosts in finally block (was permanently mutating host WinRM config)
- Setup-TemplateVM.ps1: remove duplicate MaxMemoryPerShellMB (winrm set
  + Set-Item both setting same value)

P1 doc (stale Host-Only / VMnet11 era):
- Setup-TemplateVM.ps1: rewrite NETWORK REQUIREMENT block + final steps
  (system uses VMnet8 NAT permanently, not VMnet11 Host-Only)
- Invoke-CIJob.ps1 Phase 1 comment: correct network model
- ARCHITECTURE.md: remove Git from toolchain list (not installed); clarify
  zip-transfer rationale (no PAT in VM, not network isolation)
- BEST-PRACTICES.md: rewrite Step 8 as NAT topology verification

P1 minor:
- Invoke-RemoteBuild.ps1: remove wasted first New-Item (created then
  immediately removed and recreated)
- Wait-VMReady.ps1: remove unused $elapsed; simplify try/catch around
  native command (exit codes don't throw)
- Install-Runner.ps1: add deprecation notice pointing to Setup-Host.ps1

P2 operational:
- Add scripts/Cleanup-OrphanedBuildVMs.ps1 with -WhatIf support
- Get-BuildArtifacts.ps1 -IncludeLogs: add -Recurse (msbuild logs in subdir)
- Add gitea/workflows/lint.yml (PSScriptAnalyzer on .ps1 push/PR)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Setup-Host.ps1

@@ -82,7 +82,7 @@ param(
     [string] $CIRoot                 = 'F:\CI',
     [string] $GuestCredentialTarget  = 'BuildVMGuest',
     [string] $GuestUsername          = 'ci_build',
-    [string] $GuestPassword          = 'CIBuild!ChangeMe2026',
+    [string] $GuestPassword          = '',
     [string] $ActRunnerExe           = '',
     [string] $ActRunnerConfigYaml    = '',
     [string] $GiteaUrl               = 'http://10.10.20.11:3100',
@@ -167,16 +167,19 @@ if ($existingCred) {
     Write-OK "Credential '$GuestCredentialTarget' already exists (user: $($existingCred.UserName))"
     Write-Warn "To update: Remove-StoredCredential -Target '$GuestCredentialTarget', then re-run."
 } else {
+    if ($GuestPassword -eq '') {
+        Write-Host "  No -GuestPassword supplied. Enter password for '$GuestUsername' (will be stored in Credential Manager):"
+        $secPwd      = Read-Host -Prompt "  Password" -AsSecureString
+        $bstr        = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($secPwd)
+        $GuestPassword = [System.Runtime.InteropServices.Marshal]::PtrToStringAuto($bstr)
+        [System.Runtime.InteropServices.Marshal]::ZeroFreeBSTR($bstr)
+    }
     New-StoredCredential `
         -Target   $GuestCredentialTarget `
         -UserName $GuestUsername `
         -Password $GuestPassword `
         -Persist  LocalMachine | Out-Null
     Write-OK "Credential '$GuestCredentialTarget' stored (user: $GuestUsername)"
-    if ($GuestPassword -eq 'CIBuild!ChangeMe2026') {
-        Write-Warn "Using DEFAULT password — change it before production use!"
-        Write-Warn "Edit -GuestPassword parameter and re-run, or update in Credential Manager manually."
-    }
 }
 
 # ── Step 5: Copy runner\config.yaml ──────────────────────────────────────────