[Windows] Add dependency-resolution preflight for downstream builds

[alex-harvey-z3q]

Description

Adds an opt-in, non-installing Windows dependency-resolution preflight for downstream consumers to run from the exact revision and effective Packer inputs they are about to build, before starting Packer.

-Image selects normal runner-images defaults. Supported targets are:

• Windows2022
• Windows2025
• Windows2025VS2026
• Windows11Arm64
• Windows11VS2026Arm64

Downstream consumers that prepare templates outside the checkout can supply -TemplatePath, -ToolsetPath, and -ScriptsRoot. With all three effective paths supplied, -Image is optional; partial overrides combine with image-derived defaults. ${path.root} references are resolved relative to the effective template directory and normalized to absolute filesystem paths before validation.

The preflight reports its selected inputs, static-check progress and counts, each network-check phase, and explicit network-skip status. It:

• parses PowerShell scripts beneath the effective scripts root and validates the effective template’s local references;
• resolves configured toolcache versions from the effective toolset’s manifests;
• resolves every configured Chocolatey package, including each explicit package version, from the Chocolatey community feed;
• resolves every configured PowerShell Gallery module, including each explicit module version, from the Gallery’s NuGet V2 endpoint;
• checks GitHub release assets using the actual selected inputs: the toolset-pinned Docker Compose version, the toolset-selected Selenium major version, and the correct GitHub CLI architecture;
• validates Visual Studio Marketplace metadata and the existing Microsoft VSIX download overrides; and
• retries transient endpoint failures with bounded retries and clear final errors.

For custom networked runs without -Image, -Architecture x64 or -Architecture arm64 is required so the GitHub CLI asset matches the intended image.

It does not create Azure resources, provision a VM, download installer payloads, or mutate the build machine. -SkipNetwork runs the static checks only.

The accompanying unit suite uses mocked endpoint responses and runs in the existing fast PowerShell-test workflow when the preflight changes.

Related issue:

• Refs Provide a fast Windows dependency-resolution preflight for downstream image builds #14564

Check list

• Related issue / work item is attached
• Tests are written (if applicable)
• Documentation is updated (if applicable)
• Changes are tested and related VM images are successfully generated

Validation

• Invoke-Pester -Output Detailed images/windows/scripts/preflight/tests (24 passed)
• Static preflight for all five supported -Image values
• Static preflight against a separate prepared tree using only -TemplatePath, -ToolsetPath, and -ScriptsRoot
• Nested ${path.root}/../../../shared/assets/certificates reference resolves to the expected existing directory; a missing nested path reports both original and normalized paths
• Focused live Windows 11 Arm64 GitHub release check: ARM64 GitHub CLI, pinned Docker Compose, and toolset Selenium version
• Live Chocolatey probes for Bicep and toolset-pinned cmake.install 3.31.6
• Live PowerShell Gallery probe for toolset-pinned Pester 5.9.0
• PowerShell parser and whitespace checks