Install latest Firefox and NVDA from official sources

[AnsonShie]

What changed

• Install the latest stable Firefox zh-TW 64-bit release directly from Mozilla.
• Resolve and install the latest numeric stable NVDA release directly from NV Access.
• Validate Authenticode publishers before running either installer.
• Add bounded download retries with contextual logging and fail-closed error handling.
• Prefer NVDA's current 64-bit installation path while retaining the legacy x86 path as a fallback.
• Preserve the existing AMI VERSION_* outputs and update environment verification.
• Add aggregate and per-update Windows Update ResultCode, HRESULT, and reboot diagnostics.
• Preserve failed SSM stdout and the original nonzero status in the AMI workflow.
• Replace the fixed ten-minute EC2 image waiter with observable polling for up to approximately thirty minutes.
• Log the AMI ID, state, attempt count, and StateReason; fail immediately on an actual failed state while tolerating initial InvalidAMIID.NotFound eventual consistency.
• Add Pester coverage for release filtering, retries, signatures, silent install arguments, NVDA path resolution, workflow output compatibility, Windows Update diagnostics, and AMI polling.

Why

Firefox and NVDA were installed through Chocolatey, so AMI builds depended on a third-party package feed and could lag official stable releases. Direct official downloads make the selected release source explicit and allow publisher-signature verification.

The latest NVDA release installs under C:\Program Files\NVDA; the previous fixed x86 path caused version collection and AMI verification to miss a successful current installation.

Windows Update failures previously exposed only aggregate result code 4. The workflow also captured SSM stdout but exited before printing it, hiding the update titles and HRESULT values needed for diagnosis.

The AWS CLI image-available waiter checks 40 times at 15-second intervals. A successful historical AMI build already took 9 minutes 41 seconds, leaving almost no margin before that fixed limit. The latest build exceeded it and returned exit code 255 even though all installation and environment verification steps had passed.

Impact

Each Windows accessibility AMI build now selects the publishers' current stable releases at build time. Beta, RC, ESR, Developer Edition, and Nightly builds are excluded. Failures resolving, downloading, validating, or installing the official artifacts stop the AMI build.

Windows Update remains fail-closed. On failure, the workflow reports aggregate and per-update diagnostics before returning the original nonzero status.

AMI creation can remain pending for up to about thirty minutes. Each poll is visible in the workflow log, actual failed states stop immediately with their StateReason, and the existing ami_id output contract remains unchanged.

Superpowers planning/specification artifacts are intentionally excluded from this PR.

Validation

• Pester: 23 passed, 0 failed
• Python: 45 passed, 0 failed
• PowerShell parser checks passed for all three relevant production scripts
• Bash syntax checks passed for the AMI creator, Windows Update runner, and SSM runner
• Workflow YAML parsed successfully
• git diff --check passed
• Independent code review found no Critical, Important, or Minor issues

A live AMI build and real Windows installer execution have not been rerun after the AMI polling change.