v7.0.60

Quick CI gate and diagnosable, resumable Winget publication (#121)

Turn CI into a quick gate: event-selected matrix, Suite CI, durable caches

CI had never passed (52 runs: 29 failed, 23 cancelled) while every push and
pull request launched six 60-86 minute native jobs. The Full suite's
build-toolchain lane runs a nested single-node targeted rebuild inside a
Pester test with a 15-minute timeout; on the hosted runners it recompiled
every RedSalamander source, was killed mid-compile, left the shared
dependency lease abandoned, and the re-attestation build then refused with
the DxUi "-Rebuild required" error. Because actions/cache saves only on job
success, every red run also rebuilt all vcpkg packages from source.

- ci.yml: concurrency cancels a superseded run; the native matrix is chosen
  per event (x64 Debug + ARM64 Debug on pull requests, both Release profiles
  added on pushes to main); every profile runs `Run-AllTests.ps1 -Suite CI`.
  Suite Full stays the local closeout gate.
- build-reusable.yml: `test_suite` input; vcpkg and Terminal runtime caches
  use actions/cache/restore plus explicit save steps after the dependency
  install and the solution build; Release builds on the native ARM64 host use
  one MSBuild node after the optimizer ran out of heap (C1002) on the largest
  self-test translation unit.
- asan.yml: the pull-request trigger targeted `master` and never fired; it
  now targets main for native-source changes (x64) and covers both
  architectures weekly and on dispatch, with the CI suite after the detector
  proof.
- TestHarnessSourceContracts: Tests/TestSupport/DirectedSelfTestInputWarning.h
  is the documented foreground-activation adapter (Core_SharedHelpers.md) and
  joins the reviewed focus-call list; it was failing the tooling Pester lane.
- Specs and README describe the new gate; contract tests updated.

Make Winget publication diagnosable, cheap, and resumable

The v7.0.59 release stopped in publish-winget with only "wingetcreate submit
failed with exit code 1": the module captured WingetCreate's output and
discarded it, and the rerun that did create winget-pkgs#436389 then stopped
because the fresh PR's contents stayed unreadable for all six attempts.

- Invoke-RSWingetPublication now carries WingetCreate's captured output
  (blank lines dropped, token-shaped values redacted, bounded to the last
  40 lines) in the final failure, and Pending reasons name the path, head
  commit, and upstream exception.
- Each state check read the changed-file list of the 100 most recently
  updated winget-pkgs PRs (~100 requests, ~700 per stopped publication).
  Only candidate PRs are inspected now: the token owner's, marker-bearing
  ones, and those naming the package in title, body, or head branch.
- Visibility waits carry the eventual-consistency window (15/30/45/60/60 s)
  now that a check costs a few requests.
- wingetcreate re-serializes manifests before committing them (creation
  comment, CRLF, list indentation, key order), so byte-exact hashes could
  never match the committed files. The identity and the PR content check
  hash a canonical form instead; verified equal against the manifests
  committed in winget-pkgs#436389.
- generate-manifest.ps1 gains a validated -ReleaseDate; the workflow passes
  the release's published_at date so reruns generate identical manifests
  and keep the same publication identity instead of stamping the rerun day.
- The workflow logs the token owner's classic scope names and warns when
  public_repo is missing, since winget-create does not accept fine-grained
  tokens.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>