feat(#436): real Windows installer e2e on a self-hosted nested-virt runner (RFC D5)

[shujaatTracebloc]

#436 — real Windows installer e2e (self-hosted runner, RFC-CLIENT-0003 D5)

GitHub's windows-latest runners can't nest virtualization, so install-k8s.ps1 has only mocked Pester coverage — while the bash installer gets a 9-distro prereq matrix + real-k3d e2e on every push. Regressions and never-ported behaviors stay green on Windows. This adds the missing e2e leg on a self-hosted runner that supports nested virt.

Provisioning decision: self-hosted Windows runner (Azure isn't available to us).

What's here

• .github/workflows/windows-e2e.yaml — schedule (nightly) + workflow_dispatch, not per-PR; runs-on: [self-hosted, windows, nested-virt]; concurrency-guarded; 45-min cap; uploads the install log artifact on failure; tears the cluster down every run.
• scripts/tests/e2e-windows.ps1 — the credential-free driver, mirroring e2e-journey.sh: dot-sources install-k8s.ps1 with TB_PESTER=1 (main() doesn't run) → verifies Docker/WSL up (runner prereqs; it does not reinstall Docker Desktop per run) → installs tools → runs the installer's real New-K3dCluster → applies a credential-free stub the CLI discovery keys off (labels + ingestor SA) → asserts the discovery-shaped state → checks the installer's cluster-create copy reached the log → tears down. Stops before Invoke-ProvisionClient (Steps 5–6 mint a real backend credential — out of scope), exactly as e2e-journey stops before the CLI connects.
• docs/WINDOWS-E2E.md — one-time runner setup (labels, WSL2 + Docker Desktop + nested virt, account rights) + what green/red means.
• installer-tests.yaml — e2e-windows.ps1 added to the PSScriptAnalyzer step so a syntax/verb regression fails fast on every push, not at the nightly run.

Acceptance criteria

• ✅ A deliberately broken installer commit turns the job red with the install log attached (windows-e2e-install-log artifact).
• ✅ Covers whichever Windows path is current (the PS monolith today; if D2 lands a WSL adapter, point the driver at the new entrypoint — runner setup unchanged).

Validation — please read

This is greenfield CI infra I cannot execute here (no Windows / WSL / nested-virt host). Validated locally: YAML parses; PSScriptAnalyzer clean (0 errors — the Write-Host / empty-catch / non-BOM-unicode warnings match install-k8s.ps1's own tolerated set); check-style clean. The first scheduled run on the registered runner is what shakes it out — that's inherent to this issue, and it's the acceptance test.

Before it can run (one-time, needs you/IT)

Register a self-hosted Windows runner with labels self-hosted, windows, nested-virt, WSL2 + Docker Desktop (WSL2 backend) running, on a nested-virt-capable host — see docs/WINDOWS-E2E.md.

Closes#436

---

Note

Low Risk
CI and test infrastructure only; no production installer behavior changes, though the job mutates Machine PATH and k3d state on the dedicated self-hosted runner.

Overview
Adds real end-to-end coverage for the Windows PowerShell installer where GitHub-hosted runners cannot nest virtualization—parity with the bash installer’s real-k3d path, scoped to RFC D5 (#436).

A new nightly + workflow_dispatch workflow (.github/workflows/windows-e2e.yaml) runs on [self-hosted, windows, nested-virt], with concurrency limits, a 45-minute cap, install-log upload on any non-success (!success()), and an always teardown safety net (bounded k3d delete + data-dir cleanup).

scripts/tests/e2e-windows.ps1 dot-sources install-k8s.ps1 with TB_PESTER=1, then runs the credential-free path: admin + Docker checks, tool install, pre-clean + New-K3dCluster, discovery-shaped stub assertions, install-log copy smoke check, and bounded teardown—stopping before backend provisioning like e2e-journey.sh.

docs/WINDOWS-E2E.md documents one-time runner setup (labels, WSL2/Docker, Administrator). installer-tests.yaml now PSScriptAnalyzes e2e-windows.ps1 on every push so regressions fail fast before the nightly job.

^{Reviewed by Cursor Bugbot for commit 37a6716. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit ff139c4. Configure here.}

[LukasWodka]

/fr-pass