ci: add hosted WireSock SDK experiment

[wiresock]

Adds a manually dispatched, x64-only feasibility experiment on a disposable GitHub-hosted Windows runner. It verifies the protected main tip, downloads WireSock SDK 3.4.8 through WinGet, checks the audited SHA-256 and Authenticode signature, builds and installation-tests the MSI, exercises the real SDK with synthetic IANA documentation-range profiles, and removes the SDK during cleanup. No repository secrets or real VPN credentials are used. Local validation: workflow security fixtures; production workflow contracts (7 workflows / 63 action references); PowerShell parser; actionlint for the new workflow; git diff check.

[Copilot]

Pull request overview

Adds a manually triggered GitHub-hosted Windows feasibility workflow to validate running WireSock SDK integration on an x64 disposable runner, while extending the existing workflow security/contract fixtures to account for the new workflow.

Changes:

• Adds a new workflow_dispatch-only workflow (hosted-sdk-experiment.yml) that authorizes execution only on the protected main tip before running the experiment.
• Introduces Invoke-HostedSdkExperiment.ps1 to bootstrap WinGet (if needed), download and verify the SDK installer (SHA-256 + Authenticode), build/test an MSI, run real-SDK lifecycle smoke tests, and uninstall/cleanup.
• Updates workflow security validation + tests to allow workflow_dispatch and to include the new workflow in audited production workflow contracts/digests.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
scripts/Test-WorkflowSecurity.Tests.ps1	Extends workflow security fixtures to cover workflow_dispatch and to include the new production workflow in contract fixtures.
scripts/Test-WorkflowSecurity.ps1	Adds the new workflow digest to the production contract list and permits workflow_dispatch as a canonical trigger.
scripts/Invoke-HostedSdkExperiment.ps1	New end-to-end experiment runner script: SDK acquisition/verification, build/MSI install test, integration smoke, cleanup.
README.md	Documents the hosted SDK experiment’s purpose, constraints, and how to run it.
.github/workflows/hosted-sdk-experiment.yml	New manually dispatched workflow that gates execution to the protected main tip and runs the hosted x64 experiment.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.

Suppressed comments (1)

scripts/Invoke-HostedSdkExperiment.ps1:467

• The cleanup block in this finally will throw if any of these directories cannot be removed (locked file, transient IO error, etc.), which can turn an otherwise successful experiment into a failed workflow run. Other scripts in this repo treat cleanup as best-effort and emit warnings instead (for example scripts/Test-MsiInstallation.ps1:951-1013). Consider wrapping deletions in try/catch and continuing on failure.

    if (Test-Path -LiteralPath $profileRoot) {
        Remove-Item -LiteralPath $profileRoot -Recurse -Force
    }

[wiresock]

Addressed the suppressed cleanup finding from Copilot review 4914584995 in commit 54b49b5. Environment reset, each temporary-directory deletion, and SDK uninstall are now independent best-effort cleanup operations that warn without masking the experiment result or skipping later cleanup. Verified with both normal-directory deletion and a locked-file failure simulation; PowerShell parsing, workflow security fixtures, and production workflow contracts pass.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.