test: harden e2e smoke and release reports (#1140)

* test: harden e2e inspect specs

* test: wire e2e release reports

* chore: bump packaged beta base to 0.6.1

* test: run release smoke vitest directly

* test: add suite-owned tools-dev lifecycle

* ci: harden stable release packaging

* fix(release,e2e): gate stable signing on verify and harden suite cleanup

- restore `needs: [metadata, verify]` on the stable release `build_mac`,
  `build_mac_intel`, `build_win`, and `build_linux` jobs so Apple
  signing/notarization and Windows release builds cannot run before
  pnpm guard, typecheck, and layout checks complete on the metadata commit.
- in `runToolsDevSuite`, drop the `started` flag and always attempt
  `stopToolsDevWeb` in `finally`; record stop errors in diagnostics, and
  when the test body succeeded, escalate the stop failure to the suite
  result and rethrow — so orphan daemon/web processes from an interrupted
  `startToolsDevWeb` or a broken shutdown can no longer pass silently.

Addresses PR #1140 review feedback from lefarcen and mrcfps.

.github/scripts/release/github/stable-notes.sh

@@ -17,12 +17,13 @@ cat > "$notes_file" <<EOF
 - R2 metadata: $public_origin/$RELEASE_CHANNEL/latest/metadata.json
 - E2E report: $public_origin/$RELEASE_CHANNEL/versions/$RELEASE_VERSION/report.zip
 - mac signed/notarized: $RELEASE_SIGNED
+- mac x64 signed/notarized: ${MAC_INTEL_SIGNED:-false}
 - windows signed: false
 - branch: $BRANCH_NAME
 - commit: $GITHUB_SHA
 
 See [CHANGELOG.md](https://github.com/${GITHUB_REPOSITORY}/blob/$VERSION_TAG/CHANGELOG.md) for the full release notes.
 
-This stable release ships mac arm64 DMG/update ZIP, Windows x64 NSIS installer assets, checksums, updater feed files, and a zipped packaged e2e spec report. Linux AppImage packaging remains optional through the stable Linux lane.
+This stable release ships mac arm64/x64 DMG and ZIP assets, Windows x64 NSIS installer assets, checksums, updater feed files, and a zipped packaged e2e spec report. Linux AppImage packaging remains optional through the stable Linux lane.
 EOF
 echo "notes_file=$notes_file" >> "$GITHUB_OUTPUT"

.github/scripts/release/r2/publish.sh

@@ -266,7 +266,7 @@ if (enabled("ENABLE_MAC_INTEL")) {
     arch: "x64",
     enabled: true,
     feed: null,
-    signed: false,
+    signed: env.MAC_INTEL_SIGNED === "true",
     artifacts: {
       dmg: fileEntry("mac-intel", env.MAC_INTEL_DMG, "application/x-apple-diskimage"),
       zip: fileEntry("mac-intel", env.MAC_INTEL_ZIP, "application/zip"),

.github/scripts/release/r2/summary.sh

@@ -48,7 +48,7 @@ const platforms = {
   },
   macIntel: {
     enabled: enabled("ENABLE_MAC_INTEL"),
-    signed: false,
+    signed: env.MAC_INTEL_SIGNED === "true",
   },
 };
 

.github/scripts/release/r2/verify.sh

@@ -48,6 +48,7 @@ downloaded_metadata="$RUNNER_TEMP/metadata.json"
 curl -fsSL "$R2_METADATA_URL?run=${GITHUB_RUN_ID:-local}" -o "$downloaded_metadata"
 DOWNLOADED_METADATA="$downloaded_metadata" \
 EXPECTED_CHANNEL="$RELEASE_CHANNEL" \
+EXPECTED_MAC_INTEL_SIGNED="${MAC_INTEL_SIGNED:-}" \
 EXPECTED_NIGHTLY_NUMBER="${NIGHTLY_NUMBER:-}" \
 EXPECTED_RELEASE_VERSION="$RELEASE_VERSION" \
 node --input-type=module <<'NODE'
@@ -73,6 +74,12 @@ if (metadata.channel === "beta") {
     }
   }
 }
+if (process.env.EXPECTED_MAC_INTEL_SIGNED !== "") {
+  const expected = process.env.EXPECTED_MAC_INTEL_SIGNED === "true";
+  if (metadata.platforms?.macIntel?.signed !== expected) {
+    throw new Error("unexpected metadata platforms.macIntel.signed: " + metadata.platforms?.macIntel?.signed);
+  }
+}
 NODE
 
 if [ "$ENABLE_MAC" = "true" ]; then
@@ -98,6 +105,7 @@ if [ "$ENABLE_MAC" = "true" ]; then
   fi
   require_report_file "mac/manifest.json"
   require_report_file "mac/screenshots/open-design-mac-smoke.png"
+  require_report_file "mac/suite-result.json"
   require_report_file "mac/tools-pack.json"
   require_report_file "mac/tools-pack.log"
   require_report_file "mac/vitest.log"
@@ -117,6 +125,7 @@ if [ "$ENABLE_WIN" = "true" ]; then
   curl -fsSI "$R2_WIN_INSTALLER_URL" >/dev/null
   require_report_file "win/manifest.json"
   require_report_file "win/screenshots/open-design-win-smoke.png"
+  require_report_file "win/suite-result.json"
   require_report_file "win/tools-pack.json"
   require_report_file "win/vitest.log"
 fi