Handle PowerShell native ssh stderr in smoke probes

Author: mjenkinsaktion

docs/exec-plans/active/EP-001-portable-coder-foundation-and-multi-provider-mvp.md

@@ -47,6 +47,7 @@ Initial user target providers/tools:
 - [x] (2026-02-20) Increase VM SSH readiness timeouts and diagnostics for slow first-boot cloud images
 - [x] (2026-02-20) Fix Windows smoke SSH probe command invocation so readiness check validates `echo vm-ready` output correctly
 - [x] (2026-02-20) Update Windows smoke SSH probe to pass remote commands directly (avoids PowerShell stdin encoding edge cases)
+- [x] (2026-02-20) Normalize Windows PowerShell native `ssh` stderr handling so host-key warnings do not abort readiness probes
 - [ ] (2026-02-18) Document setup/runbook and close out EP-001
 
 ## Context and Orientation
@@ -129,6 +130,7 @@ Acceptance criteria for EP-001:
 - 2026-02-20: First boot SSH readiness on some hosts can exceed 120 seconds, so timeout windows need to be configurable and longer by default.
 - 2026-02-20: Passing `ssh ... bash -lc <script>` as split args can drop expected output semantics; piping script content to `bash -s` is safer for deterministic probing.
 - 2026-02-20: Piping probe scripts into native `ssh` from Windows PowerShell can hit stdin encoding edge cases; direct remote command args are more reliable.
+- 2026-02-20: In Windows PowerShell, native stderr can surface as terminating `ErrorRecord` when `$ErrorActionPreference='Stop'`, so probe wrappers must normalize stderr explicitly.
 
 ## Decision Log
 - 2026-02-18: Adopt harness-first planning model before implementation.

scripts/runtime/windows/smoke-check.ps1

@@ -69,17 +69,36 @@ function Invoke-Ssh {
     $Script
   )
 
+  $previousErrorAction = $ErrorActionPreference
   try {
-    $output = & $SshExe @args 2>&1
+    # Native ssh writes host-key notices to stderr; keep stderr non-terminating for probe loops.
+    $ErrorActionPreference = 'Continue'
+    $rawOutput = & $SshExe @args 2>&1
+    $exitCode = $LASTEXITCODE
+
+    $normalized = @()
+    foreach ($entry in @($rawOutput)) {
+      if ($null -eq $entry) {
+        continue
+      }
+      if ($entry -is [System.Management.Automation.ErrorRecord]) {
+        $normalized += $entry.ToString()
+      } else {
+        $normalized += [string]$entry
+      }
+    }
+
     return @{
-      status = $LASTEXITCODE
-      output = [string]::Join("`n", $output)
+      status = $exitCode
+      output = [string]::Join("`n", $normalized)
     }
   } catch {
     return @{
       status = 1
       output = $_.Exception.Message
     }
+  } finally {
+    $ErrorActionPreference = $previousErrorAction
   }
 }