Improve Windows A11y AMI provisioning and EC2 lifecycle

[AnsonShie]

What changed

• Install the latest stable Firefox zh-TW 64-bit release directly from Mozilla.
• Resolve and install the latest numeric stable NVDA release directly from NV Access.
• Validate Authenticode publishers before running either installer.
• Add bounded official-download retries and fail-closed installer handling.
• Support NVDA's current 64-bit installation path while retaining the legacy x86 fallback.
• Preserve the existing AMI VERSION_* output contracts and environment verification.
• Report aggregate and per-update Windows Update ResultCode, HRESULT, and reboot diagnostics.
• Retry only known transient Windows Update shutdown/service/busy failures with a bounded limit.
• Wait for the SSM Agent to return Online after a reboot before starting the next update pass.
• Replace the fixed ten-minute EC2 image waiter with observable AMI polling for up to approximately thirty minutes.
• Log AMI state and StateReason while tolerating initial InvalidAMIID.NotFound eventual consistency.
• Change Launch Windows A11y EC2 into Manage Windows A11y EC2 with explicit launch and delete operations.
• Build every managed CloudFormation name as windows-a11y-<stack_suffix>.
• Require the complete generated stack name before deleting a stack, then wait for stack deletion to finish.
• Show the fixed prefix, generated full stack name, and operation result in the GitHub Actions summary.

Why

Firefox and NVDA previously depended on a third-party package feed that could lag official stable releases. Official downloads make the selected source explicit and allow publisher-signature verification.

Windows Update errors were difficult to diagnose and could recur while Windows was still completing a reboot. Numeric HRESULT logging and narrowly scoped retries make transient readiness failures recoverable without hiding permanent errors.

The standard AWS CLI AMI waiter had almost no margin beyond successful historical build times. Explicit polling distinguishes a slow pending image from an actual failed image.

The manual Windows A11y EC2 workflow could launch or update a stack but could not remove one. The workflow now manages both lifecycle operations while enforcing a dedicated naming prefix and an explicit destructive-action confirmation.

Behavior and safety

• stack_suffix=anson-test resolves to windows-a11y-anson-test.
• Stack suffixes accept lowercase letters, numbers, and internal hyphens only.
• A suffix that already includes windows-a11y- is rejected to prevent a duplicated prefix.
• Launch requests require an AMI version label.
• Delete requests require confirm_stack_name=windows-a11y-anson-test for that exact suffix.
• A missing stack, mismatched confirmation, invalid suffix, permanent Windows Update error, or failed AMI state stops the workflow.
• The legacy un-suffixed windows-a11y stack is intentionally not supported by the new management interface.

Superpowers planning and specification artifacts are intentionally excluded from this PR.

Validation

• Pester: 37 passed, 0 failed
• actionlint 1.7.12: passed for launch-windows-a11y-ec2.yml
• Bash syntax checks passed
• PowerShell parser and behavior coverage passed through the Pester suite
• git diff --check passed

No live AMI build, EC2 launch, or CloudFormation deletion was run for these latest changes.