fix(ansible): harden WinRM deploy wrapper with md4+retry

ansible/run_deploy_aw_windows.sh

@@ -4,6 +4,10 @@ set -euo pipefail
 # WinRM uses requests/pywinrm which may pick up local proxy settings (systemd env, shells, etc).
 # If that happens, WinRM traffic can be sent to 127.0.0.1:<proxy> and time out.
 # This wrapper hard-disables proxy env vars to make deploy deterministic.
+#
+# Also, NTLM auth requires MD4. On OpenSSL 3 builds where MD4 is disabled by default,
+# pywinrm fails with "unsupported hash type md4". In that case we enable OpenSSL legacy
+# provider only for this process.
 
 if [[ -z "${AW_WINRM_PASSWORD:-}" ]]; then
   echo "ERROR: AW_WINRM_PASSWORD is not set" >&2
@@ -13,5 +17,41 @@ fi
 
 unset http_proxy https_proxy HTTP_PROXY HTTPS_PROXY all_proxy ALL_PROXY
 
-exec ansible-playbook -i inventory.ini deploy_aw_windows.yml "$@"
+if ! python3 - <<'PY' >/dev/null 2>&1
+import hashlib
+raise SystemExit(0 if 'md4' in hashlib.algorithms_available else 1)
+PY
+then
+  cat >/tmp/openssl-legacy.cnf <<'EOF'
+openssl_conf = openssl_init
+[openssl_init]
+providers = provider_sect
+[provider_sect]
+default = default_sect
+legacy = legacy_sect
+[default_sect]
+activate = 1
+[legacy_sect]
+activate = 1
+EOF
+  export OPENSSL_CONF=/tmp/openssl-legacy.cnf
+fi
 
+retries="${AW_DEPLOY_RETRIES:-5}"
+delay="${AW_DEPLOY_RETRY_DELAY_SEC:-30}"
+
+attempt=1
+while [[ "$attempt" -le "$retries" ]]; do
+  echo "Deploy attempt $attempt/$retries"
+  if ansible-playbook -i inventory.ini deploy_aw_windows.yml "$@"; then
+    exit 0
+  fi
+  if [[ "$attempt" -lt "$retries" ]]; then
+    echo "Deploy attempt $attempt failed; sleeping ${delay}s before retry..." >&2
+    sleep "$delay"
+  fi
+  attempt=$((attempt + 1))
+done
+
+echo "Deploy failed after ${retries} attempts." >&2
+exit 1