[coneilen]

Summary

Reduce Windows pull-request latency by running the source-only validation runner once in parallel instead of repeating it sequentially in the Swift job and in both hardening matrix legs.

Changes

• add a dedicated, pinned Windows 2022 validation-runner job to the required windows-spikes fan-in
• keep Windows 2022 and Windows 2025 hardening coverage while suppressing duplicate PR runner executions
• retain one Windows 2022 runner fallback for independent scheduled and manually dispatched hardening runs
• require an exact PASS marker and emit VALIDATION_RUNNER_EXECUTED=1
• add a fail-closed topology contract for the job, fan-in, event conditions, and positive execution marker

Test plan

RED: pwsh -NoProfile -File Tools\windows\Tests\WindowsCiTopology.Tests.ps1 -> RED: Windows port CI needs a dedicated validation-runner job
GREEN: pwsh -NoProfile -File Tools\windows\Tests\WindowsCiTopology.Tests.ps1 -> Windows CI topology: 13 checks, 0 failures
REGRESSION: pwsh -NoProfile -File Tools\windows\Invoke-ValidationRunnerContract.ps1 -> VALIDATION_RUNNER_EXECUTED=1; UiCaptureDriver 182/182

• pwsh -NoProfile -File Tools\windows\Invoke-ValidationRunnerContract.ps1 -> passed; ValidationRunner.Tests.ps1: PASS, UiCaptureDriver 182/182, ActionWindowIdentity 62/62, WireTargeting 56/56
• pwsh -NoProfile -File Tools\windows\validate.ps1 -Task hardening -> passed; deterministic fixtures repeated 3/3
• bash Tools/ci/tests/classify-changes.test.sh -> 80 passed, 0 failed
• Python yaml.safe_load for both changed workflows -> 2 files parsed
• git diff --check and LF checks -> passed for all changed files

Evidence limit: this workflow-only change did not consume the foreground UIA slot or rerun product behavior. Existing live UIA, cleanup, identity, deadline, packaging, provider, and hardening coverage remains required in CI.

Checklist

• I have read the Contributing Guidelines
• I have signed off my commits (git commit -s) per the DCO
• Tests pass locally (make test) — not run; this is a Windows-only workflow change and the exact Windows contracts above passed
• Code follows the existing style (make check) — not run; macOS Swift formatting surfaces were not changed
• I added the test/contract before the implementation and observed the intended RED failure