fix: apply all FIX-TODO items (P0/P1/P2)

P0 bugs:
- Invoke-CIJob.ps1: skip --depth 1 when $Commit specified (shallow clone
  + checkout specific commit was silently failing)
- Get-BuildArtifacts.ps1: check .Length -eq 0 not rounded sizeKB (false
  fail on artifacts smaller than 50 bytes)
- build-nsis.yml: upgrade upload-artifact v3 -> v4 (v3 deprecated)

P0 security:
- Remove hardcoded default password CIBuild!ChangeMe2026 from all scripts,
  README, TODO; prompt Read-Host -AsSecureString at runtime instead
- Setup-TemplateVM.ps1: replace `net user $u $p /add` (password in argv /
  audit log 4688) with New-LocalUser + local ConvertTo-SecureString
- Prepare-TemplateSetup.ps1: save and restore WSMan AllowUnencrypted +
  TrustedHosts in finally block (was permanently mutating host WinRM config)
- Setup-TemplateVM.ps1: remove duplicate MaxMemoryPerShellMB (winrm set
  + Set-Item both setting same value)

P1 doc (stale Host-Only / VMnet11 era):
- Setup-TemplateVM.ps1: rewrite NETWORK REQUIREMENT block + final steps
  (system uses VMnet8 NAT permanently, not VMnet11 Host-Only)
- Invoke-CIJob.ps1 Phase 1 comment: correct network model
- ARCHITECTURE.md: remove Git from toolchain list (not installed); clarify
  zip-transfer rationale (no PAT in VM, not network isolation)
- BEST-PRACTICES.md: rewrite Step 8 as NAT topology verification

P1 minor:
- Invoke-RemoteBuild.ps1: remove wasted first New-Item (created then
  immediately removed and recreated)
- Wait-VMReady.ps1: remove unused $elapsed; simplify try/catch around
  native command (exit codes don't throw)
- Install-Runner.ps1: add deprecation notice pointing to Setup-Host.ps1

P2 operational:
- Add scripts/Cleanup-OrphanedBuildVMs.ps1 with -WhatIf support
- Get-BuildArtifacts.ps1 -IncludeLogs: add -Recurse (msbuild logs in subdir)
- Add gitea/workflows/lint.yml (PSScriptAnalyzer on .ps1 push/PR)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docs/ARCHITECTURE.md

@@ -116,8 +116,8 @@ The runner host **never executes build tools directly**. Its only role is orches
 - Visual Studio Build Tools **2026** (MSBuild 18.5.4 / toolset v145)
 - .NET SDK **10.0.203**
 - Python **3.13.3** (per build script personalizzati come `build_plugin.py`)
-- Git (per repo clone inside VM)
 - NuGet CLI (optional, dotnet restore covers most cases)
+- Git: NOT installed by default — source arrives via WinRM zip transfer. See TODO.md `-UseGitClone` for the in-VM git clone opt-in path.
 
 ---
 
@@ -191,4 +191,4 @@ VMs have internet access via NAT — required for pip/nuget during build.
 - WinRM credentials are stored in Windows Credential Manager on host (not hardcoded)
 - Each VM is fully destroyed after the job — no state carries between builds
 - Runner host does not expose any ports to the build VM network
-- Source code is transferred via zip (Compress-Archive → WinRM copy → Expand-Archive in guest) — no git clone inside VM
+- Source code is transferred via zip (Compress-Archive → WinRM copy → Expand-Archive in guest) — no PAT is ever present inside the VM; VMs have NAT internet for pip/nuget at build time

docs/BEST-PRACTICES.md

@@ -233,27 +233,31 @@ Get-EventLog -LogName Application -Source '*runner*' -Newest 20
 
 ---
 
-## 8. Network Isolation Verification
+## 8. Network Topology Verification
 
-After setting up the host-only VMware network, verify that build VMs cannot
-reach the internet (important for supply-chain security):
+Build VMs run on **VMnet8 (NAT)** — they have internet access, which is required
+for pip/nuget package downloads at build time. Verify the expected topology:
 
 ```powershell
-# From inside a build VM via WinRM:
+# From inside a build VM via WinRM — confirm NAT internet is reachable:
 Invoke-Command -Session $session -ScriptBlock {
     $result = Test-Connection 8.8.8.8 -Count 1 -Quiet
     if ($result) {
-        Write-Warning "VM has internet access — check VMware network adapter type"
+        Write-Host "VM has NAT internet access — expected for pip/nuget builds."
     } else {
-        Write-Host "VM correctly isolated (no internet)"
+        Write-Warning "VM cannot reach internet — pip/nuget installs will fail. Check VMware NAT service."
     }
 }
 ```
 
-Build VMs should only reach:
-- The host (for WinRM connection)
-- Gitea server (for git clone, if reachable via host-only network)
-- NuGet cache share (host-side shared folder)
+Build VMs can reach:
+- The host via VMnet8 gateway (WinRM on port 5985)
+- Internet via VMware NAT (for pip, nuget, npm at build time)
+- Gitea server if on LAN reachable via NAT gateway
+
+**Supply-chain note:** Source code is always injected by the host via WinRM zip
+transfer — never cloned inside the VM using a PAT. This keeps credentials off
+the VM even though the VM has outbound internet access.
 
 ---