Fix hosted SDK native architecture validation

[wiresock]

Summary

• run full hosted SDK lifecycle validation only on native x64 and ARM64 GitHub runners
• download the two audited WireSock SDK artifacts directly so ARM64 does not depend on unavailable WinGet/NuGet bootstrap components
• keep exact SHA-256, Authenticode, PE-architecture, and protected-main trust checks
• document why x86 SDK lifecycle needs a native 32-bit/self-hosted environment while ordinary CI retains x86 package coverage

Failure analysis

• ARM64 run 31683240223 failed before SDK download because the native ARM image could not bootstrap the legacy NuGet provider used by Microsoft.WinGet.Client
• x86 downloaded and verified correctly but the SDK installer returned 0x81F40001; its upstream WiX source explicitly permits x86 installation only when VersionNT64 is absent

Validation

• ./scripts/Test-WorkflowSecurity.Tests.ps1
• ./scripts/Test-WorkflowSecurity.ps1 -RequireProductionContracts
• git diff --check
• direct x64 SDK download: pinned ABFEEBDC...D33E, valid Authenticode signature
• direct ARM64 SDK download: pinned 62F641A1...B311, valid Authenticode signature

[Copilot]

Pull request overview

This PR updates the “Hosted WireSock SDK experiment” to run only on native x64 and ARM64 GitHub-hosted runners, and switches SDK acquisition from WinGet bootstrapping to direct downloads of the audited installer artifacts, while keeping the existing trust/verification checks aligned with the hardened workflow-security gates.

Changes:

• Restricts hosted SDK lifecycle validation to x64 and ARM64 (drops x86 from the hosted experiment matrix).
• Updates the hosted experiment script to download audited SDK installer artifacts directly (removing WinGet bootstrap dependency) and keeps SHA-256 + Authenticode verification.
• Refreshes workflow-security production digests and documentation to match the new hosted experiment behavior and rationale.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
scripts/Test-WorkflowSecurity.ps1	Updates production workflow digest and required hosted SDK matrix lines to match the new x64/ARM64-only workflow.
scripts/Invoke-HostedSdkExperiment.ps1	Removes x86 support, removes WinGet bootstrap, and downloads/validates audited SDK installer artifacts directly for x64/ARM64.
README.md	Documents why hosted validation is x64/ARM64-only and why x86 SDK lifecycle validation needs a native 32-bit/self-hosted environment.
.github/workflows/hosted-sdk-experiment.yml	Updates the hosted experiment workflow matrix and logging to run only x64 and ARM64.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.