test(plan): Update prerequisites + add §6.6 Tier-1 Toolchain test section

Mark verified prerequisites (2026-05-10):
- [x] Template VM WinBuild2025.vmx + BaseClean snapshot
- [x] F:\CI\ directory structure
- [x] act_runner service running
- [x] Pester v5.7.1 installed
- [x] CredentialManager module

Add test section for §6.6 (Git + 7-Zip):
- Step 11 installation validation
- Git command + clone test
- 7-Zip command + compression test
- In-VM git availability (prereq for §3.3)

Update Success Criteria:
- [x] Git (v2.47.0+) in template + PATH
- [x] 7-Zip (v24.07+) in template + PATH
- [x] Final pre-snapshot gate validates both tools

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docs/TEST-PLAN-v1.3-to-HEAD.md

@@ -21,12 +21,13 @@ Organized by sprint area with pre-requisites, test steps, and pass/fail criteria
 ## Pre-Test Checklist
 
 - [x] Host Windows 11 with VMware Workstation 17+
-- [ ] Template VM `F:\CI\Templates\WinBuild2025\WinBuild2025.vmx` exists + BaseClean snapshot present
+- [x] Template VM `F:\CI\Templates\WinBuild2025\WinBuild2025.vmx` exists + BaseClean snapshot present (verified 2026-05-10)
-- [ ] `F:\CI\` directory structure intact (BuildVMs, Artifacts, Logs, Cache, State)
+- [x] `F:\CI\` directory structure intact (BuildVMs, Artifacts, Logs, Cache, State) (verified 2026-05-10)
-- [ ] act_runner service running (`Get-Service act_runner | Select Status`)
+- [x] act_runner service running (`Get-Service act_runner | Select Status`) (verified 2026-05-10)
 - [ ] Gitea available at `http://10.10.20.11:3100` or `https://gitea.emulab.it`
-- [ ] PowerShell ≥5.1, Pester v5 installed (`Install-Module Pester -MinimumVersion 5.0 -Force`)
+- [x] PowerShell ≥5.1, Pester v5 installed (`Install-Module Pester -MinimumVersion 5.0 -Force`) (Pester 5.7.1 installed 2026-05-10)
-- [ ] CredentialManager module installed (`Install-Module CredentialManager`)
+- [x] CredentialManager module installed (`Install-Module CredentialManager`) (verified 2026-05-10)
+- [x] **[NEW 2026-05-10]** Template includes §6.6 Tier-1 Toolchain: Git for Windows + 7-Zip (Step 11 in Setup-WinBuild2025.ps1)
 
 ---
 
@@ -706,6 +707,57 @@ if (Test-Path 'C:\Program Files\7-Zip\7z.exe') {
 
 ---
 
+## §6.6 Tier-1 Toolchain (Git + 7-Zip)
+
+**What changed**: Step 11 added to Setup-WinBuild2025.ps1 to install Git for Windows and
+7-Zip in the template VM. Critical for §3.3 (In-VM Git clone) and cross-platform builds.
+
+**Files affected**:
+- `template/Setup-WinBuild2025.ps1` (Step 11: Git + 7-Zip installation)
+- `runner/config.yaml` (updated GITEA_CI_TEMPLATE_PATH)
+
+**Test Steps** (run after template is provisioned with Setup-WinBuild2025.ps1):
+
+```powershell
+# 1. Verify Git is installed and in PATH
+git --version
+# Expected: git version 2.47.0.windows.1 (or later)
+
+# 2. Verify Git can clone
+git clone --depth 1 https://github.com/git-for-windows/git.git C:\Temp\git-test
+# Expected: repo cloned successfully (only test if internet available)
+Remove-Item C:\Temp\git-test -Recurse -Force -ErrorAction SilentlyContinue
+
+# 3. Verify 7-Zip is installed
+7z --version
+# Expected: 7-Zip (or "7z.exe" path listed)
+
+# 4. Verify 7-Zip can compress/decompress
+$testFile = 'C:\Temp\test-7z.txt'
+Set-Content $testFile 'test data'
+7z a 'C:\Temp\test.7z' $testFile
+7z x 'C:\Temp\test.7z' -o'C:\Temp\test-extract' -y
+Test-Path 'C:\Temp\test-extract\test-7z.txt'
+# Expected: All operations succeed, file extracted correctly
+
+# 5. Test Git in Invoke-RemoteBuild context (in-VM)
+# When -UseGitClone is implemented, this validates the path:
+& vmrun -T ws runProgramInGuest -activeWindow -interactive `
+    'F:\CI\Templates\WinBuild2025\WinBuild2025.vmx' `
+    C:\Windows\System32\cmd.exe "/c git --version"
+# Expected: git version displayed (validates in-guest git availability)
+```
+
+**Pass Criteria**:
+- [x] Step 11 executes without errors in Setup-WinBuild2025.ps1
+- [x] Git command available post-setup (machine PATH includes Git)
+- [x] 7-Zip command available post-setup (C:\Program Files\7-Zip\7z.exe)
+- [x] Final pre-snapshot gate includes git + 7z validation
+- [x] Both tools survive template snapshot + linked clone cycle
+- [ ] In-VM git clone tested end-to-end with -UseGitClone flag (§3.3 implementation pending)
+
+---
+
 ## Security Items (Deferred)
 
 The following security tasks are deferred to "Home Lab" section due to being excessive
@@ -763,6 +815,9 @@ $testGroups | ForEach-Object {
 - [ ] _Common.psm1 imported by all relevant scripts
 - [ ] PSScriptAnalyzer finds no critical violations
 - [ ] BEST-PRACTICES.md §2.1 documents threat model clearly
+- [x] Git for Windows (v2.47.0+) installed in template, in PATH (§6.6)
+- [x] 7-Zip (v24.07+) installed in template, in PATH (§6.6)
+- [x] Final pre-snapshot gate validates git + 7z availability (§6.6)
 
 ---
 
@@ -780,4 +835,4 @@ After validating new features, run one full end-to-end build to ensure nothing b
 
 # Expected: Build completes successfully, artifact created, JSONL log present, no errors
 ```
-
+