ci: expand hosted SDK architecture coverage

[wiresock]

Summary

• expand the protected hosted SDK experiment from x64 to x86, x64, and ARM64
• select architecture-specific WinGet installers by audited SHA-256 and reject a signed SDK DLL with the wrong PE machine type
• run the matrix after current main updates, weekly, and by manual dispatch
• lock the schedule, runner mapping, matrix, authorized checkout, and platform-bound invocation into the workflow security contract

Runner matrix

• x86: windows-latest x64 host
• x64: windows-latest x64 host
• ARM64: native windows-11-arm host

Each job builds and installation-tests the matching no-UWP MSI and exercises Transparent, VirtualAdapter, Kill Switch, and Amnezia synthetic SDK lifecycles. External connectivity remains deliberately out of scope.

Validation

• all three SDK installer hashes verified against Microsoft WinGet package NTKERNEL.WireSockVPNClientCLI 3.4.8
• PowerShell parser validation passed
• PE helper distinguished native x64 and SysWOW64 x86 binaries
• workflow security adversarial fixtures passed
• production workflow contracts passed
• git diff --check passed

The real SDK matrix is intentionally restricted to the current protected main tip, so it will run automatically after this PR is merged.

[Copilot]

Pull request overview

Expands hosted SDK validation across x86, x64, and ARM64 while preserving protected-main authorization.

Changes:

• Adds scheduled and push-triggered architecture matrix runs.
• Selects audited installers and validates SDK PE architecture.
• Extends workflow security contracts and documentation.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
.github/workflows/hosted-sdk-experiment.yml	Adds triggers and architecture matrix.
scripts/Invoke-HostedSdkExperiment.ps1	Implements architecture-specific validation and builds.
scripts/Test-WorkflowSecurity.ps1	Locks the expanded workflow contract.
README.md	Documents hosted matrix behavior.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.