Harden Windows smoke SSH retry handling

Author: mjenkinsaktion

docs/exec-plans/active/EP-001-portable-coder-foundation-and-multi-provider-mvp.md

@@ -43,6 +43,7 @@ Initial user target providers/tools:
 - [x] (2026-02-20) Fix Windows bootstrap `ssh-keygen` argument handling for empty-passphrase key generation
 - [x] (2026-02-20) Fix Windows VM start cloud-init port selection to fallback when default range is exhausted
 - [x] (2026-02-20) Add Windows helper script to patch legacy `start-vm.ps1` cloud-init port fallback on existing local clones
+- [x] (2026-02-20) Make Windows smoke SSH probe tolerate transient native-command connection errors during VM boot
 - [ ] (2026-02-18) Document setup/runbook and close out EP-001
 
 ## Context and Orientation
@@ -121,6 +122,7 @@ Acceptance criteria for EP-001:
 - 2026-02-20: Windows VM smoke validation remains target-specific and is still tracked separately from Linux-host checks.
 - 2026-02-20: PowerShell `Start-Process -ArgumentList` rejected empty elements, so `ssh-keygen -N` required explicit empty-string handling.
 - 2026-02-20: Some Windows hosts had no free ports in `38080-38120`; cloud-init server startup now needs fallback port allocation.
+- 2026-02-20: On some PowerShell environments, transient `ssh` connection failures surfaced as exceptions; smoke probing must retry instead of aborting early.
 
 ## Decision Log
 - 2026-02-18: Adopt harness-first planning model before implementation.

scripts/runtime/windows/smoke-check.ps1

@@ -67,10 +67,17 @@ function Invoke-Ssh {
     'bash', '-lc', $Script
   )
 
-  $output = & $SshExe @args 2>&1
-  return @{
-    status = $LASTEXITCODE
-    output = [string]::Join("`n", $output)
+  try {
+    $output = & $SshExe @args 2>&1
+    return @{
+      status = $LASTEXITCODE
+      output = [string]::Join("`n", $output)
+    }
+  } catch {
+    return @{
+      status = 1
+      output = $_.Exception.Message
+    }
   }
 }