fix(TST-25,TST-26): restore Windows/x86 CI tier via SSH-driven windev job

The `windows`/`live-mxaccess` CI jobs were removed in abb0930 because Gitea
act_runner host-mode on Windows is broken and a runs-on gate with no runner
wedges the queue. This left the entire x86/net48 Worker + Worker.Tests tier
(and the live-MXAccess smoke) unguarded by CI.

Restore it without a native Windows runner: Linux jobs on ubuntu-latest (which
always schedule) SSH to windev (10.100.0.48), fetch+checkout the SHA under test
in an isolated clone C:\build\mxaccessgw-ci, run the x86 build/tests there, and
propagate the remote exit code back — so a Worker regression turns the job red
and an unreachable host fails loud (never stuck).

- scripts/ci/run-windev-ci.sh: Linux driver (key/known-hosts, UTF-16LE base64
  EncodedCommand bootstrap, ssh, exit-code passthrough).
- scripts/ci/windev-worker-ci.ps1: windev stage — worktree lock, re-fetch/
  checkout under lock, build|test|live modes; PS 5.1-safe, checks $LASTEXITCODE.
- scripts/ci/windev.known_hosts: pinned host keys for StrictHostKeyChecking.
- scripts/ci/README.md: operator bring-up + acceptance checklist.
- ci.yml: windows-x86 (per-push `test`) + nightly-windev (scheduled `live` +
  on-failure Gitea issue); drop the removal note; fix header/cron comments.

TST-26 (same commit, by rule): correct docs/scripts that still describe the
removed jobs — GatewayTesting.md, Contracts.md, check-codegen.ps1 — and
reattribute the Generated/-commit guard (primary = check-codegen diff in the
portable job; secondary = windows-x86 net48 compile).

Mechanism hand-verified on windev: build->0, bogus-SHA->nonzero (lock released),
test->356 passed/0 failed in ~50s, ssh exit-code propagation confirmed. Merge
requires operator bring-up first (dedicated ci@ key + Gitea secrets) or the
per-push job is red every push — see scripts/ci/README.md.

.gitea/workflows/ci.yml

@@ -2,15 +2,19 @@
 #
 # Scope note: the x86 Worker (src/ZB.MOM.WW.MxGateway.Worker) and Worker.Tests target
 # .NET Framework 4.8 / x86 and need MXAccess COM installed, so they build ONLY on a Windows host.
-# They are out of scope for this Linux `portable` job — the `windows` job below (self-hosted windev
-# runner) covers them, and live-MXAccess integration runs are scheduled-only so they never gate a push.
+# They are out of scope for this Linux `portable` job — the `windows-x86` job below builds and
+# tests them on windev (10.100.0.48) over SSH (see scripts/ci/run-windev-ci.sh), and the nightly
+# `nightly-windev` job additionally runs the live-MXAccess smoke, which is scheduled-only so it
+# never gates a push.
 name: ci
 
 on:
   push:
   pull_request:
   schedule:
-    # Nightly live-MXAccess smoke (windev). Push/PR runs skip the live-mxaccess job.
+    # 06:00 UTC nightly: the `nightly-windev` job re-runs the x86 Worker build + full Worker.Tests on
+    # windev, then the live-MXAccess smoke (MXGATEWAY_RUN_LIVE_MXACCESS_TESTS=1) and a full-slnx build.
+    # Push/PR runs skip it — the job is gated `if: github.event_name == 'schedule'`.
     - cron: '0 6 * * *'
 
 jobs:
@@ -120,12 +124,52 @@ jobs:
       - name: Verify generated tree is clean
         run: git diff --exit-code -- clients/java/src/main/generated
 
-  # NOTE: there is intentionally no `windows` or `live-mxaccess` job here.
-  # The x86 / net48 Worker and live-MXAccess tests need a Windows host, but Gitea's act_runner
-  # v0.6.1 host-mode on Windows is broken (its hostexecutor writes each step's script to a path it
-  # then cannot resolve, independent of shell; it also cannot stage JS actions), and Windows
-  # containers are impractical for the net48/x86/MXAccess Worker. A gated job that no runner can
-  # satisfy sticks in "queued" forever (it only resolves to "skipped" when a matching runner
-  # exists), so keeping it here blocks every run from completing. x86 Worker + live-MXAccess
-  # verification therefore stays on the manual windev worktree process (see CLAUDE.md /
-  # docs/GatewayTesting.md). Restore these jobs only alongside a Windows runner that actually works.
+  windows-x86:
+    # TST-25: x86 / net48 Worker build + Worker.Tests, executed on windev (10.100.0.48) over SSH.
+    # Runs on a Linux runner so it ALWAYS schedules — act_runner host-mode on Windows is broken (its
+    # hostexecutor writes each step's script to a path it cannot resolve, and it cannot stage JS
+    # actions), and a `runs-on` gate with no matching runner wedges the queue in "queued" forever.
+    # An unreachable windev fails this job RED (loud), never leaves it stuck. A red job can mean the
+    # Windows tier is down rather than the change — see docs/GatewayTesting.md § Continuous Integration.
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Worker x86 build + tests on windev
+        env:
+          WINDEV_SSH_KEY: ${{ secrets.WINDEV_SSH_KEY }}
+          WINDEV_SSH_KNOWN_HOSTS: ${{ secrets.WINDEV_SSH_KNOWN_HOSTS }}
+          WINDEV_SSH_USER: ${{ vars.WINDEV_SSH_USER }}
+          CI_SHA: ${{ github.sha }}
+        # `test` = x86 build + Worker.Tests (~50s measured on windev). Demote to `build` only if the
+        # test step ever exceeds ~10 min; the x86 build alone still guards the net48/CS0246/x86 class.
+        run: ./scripts/ci/run-windev-ci.sh test
+
+  nightly-windev:
+    # TST-25: scheduled deep run — full Worker.Tests + live-MXAccess smoke + full-slnx build on windev.
+    # Gated to the schedule event via `if:` (not an unsatisfiable `runs-on`), so push/PR runs mark it
+    # skipped, not queued. Never gates a push. On failure it opens a Gitea issue so a red nightly is
+    # visible even though nobody watches the Actions page.
+    if: github.event_name == 'schedule'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Full Worker.Tests + live-MXAccess smoke on windev
+        env:
+          WINDEV_SSH_KEY: ${{ secrets.WINDEV_SSH_KEY }}
+          WINDEV_SSH_KNOWN_HOSTS: ${{ secrets.WINDEV_SSH_KNOWN_HOSTS }}
+          WINDEV_SSH_USER: ${{ vars.WINDEV_SSH_USER }}
+          CI_SHA: ${{ github.sha }}
+        run: ./scripts/ci/run-windev-ci.sh live
+      - name: Report a red nightly as a Gitea issue
+        if: failure()
+        run: |
+          curl -sSf -X POST \
+            -H "Authorization: token ${{ github.token }}" \
+            -H "Content-Type: application/json" \
+            "${{ github.server_url }}/api/v1/repos/${{ github.repository }}/issues" \
+            -d "{\"title\":\"nightly-windev failed on ${{ github.sha }}\",\"body\":\"The scheduled windev Worker + live-MXAccess run failed: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} . A red nightly may mean the Windows tier is down rather than the change — see docs/GatewayTesting.md (Continuous Integration).\"}"
+
+  # NOTE: there is intentionally no native `windows` runner job. act_runner v0.6.1 host-mode on
+  # Windows is broken and Windows containers are impractical for the net48/x86/MXAccess Worker, so the
+  # Windows tier runs via the SSH-driven `windows-x86` (per-push) and `nightly-windev` (scheduled)
+  # jobs above. Restore a native job only alongside a Windows runner that actually works.