ci: collect native APK and screenshot evidence on Gitea

Bootstrap checksum-pinned ARM64 Node before Mac checkout, upload a dedicated installable native debug APK, collect AGP test output before UTP uninstall and reject stale/missing screenshots. Add five screenshot-output regressions and enforce native shipping-source invariants. Workflow lint, 10 runner and 8 JUnit verifier regressions pass; remote execution is not yet verified.

.gitea/workflows/android.yml

@@ -37,8 +37,16 @@ jobs:
           python3 -m py_compile scripts/*.py
           python3 scripts/test-verifier.py
           python3 scripts/test-ci-runner.py
+          python3 scripts/test-integration-evidence.py
       - name: Check dependencies against OSV
         run: python3 scripts/check-dependencies.py
+      - name: Upload installable native debug preview
+        uses: https://gitea.com/actions/upload-artifact@c6a3b2bd78b3985e4b2f15397fec357f0fd808de
+        with:
+          name: android-native-debug-apk
+          path: android/app/build/outputs/apk/debug/app-debug.apk
+          if-no-files-found: error
+          retention-days: 14
       - uses: https://gitea.com/actions/upload-artifact@c6a3b2bd78b3985e4b2f15397fec357f0fd808de # v3.2.2-node20 (Gitea artifact protocol)
         if: always()
         with:
@@ -96,7 +104,9 @@ jobs:
         if: always()
         with:
           name: android-device-test-reports-${{ matrix.api }}
-          path: android/app/build/reports/androidTests/
+          path: |
+            android/app/build/reports/androidTests/
+            android/app/build/outputs/native-screenshots/
           retention-days: 14
       - name: Remove only this job's allocated upstream fixture
         if: always()

.gitea/workflows/ios.yml

@@ -14,6 +14,25 @@ jobs:
     runs-on: macos-arm64
     timeout-minutes: 60
     steps:
+      - name: Bootstrap verified native Node before JavaScript actions
+        run: |
+          set -euo pipefail
+          test "$(uname -s)" = Darwin && test "$(uname -m)" = arm64
+          cache="${RUNNER_TOOL_CACHE:-$HOME/.cache/yuvomi-tools}"
+          target="$cache/yuvomi-node-22.22.1-darwin-arm64"
+          mkdir -p "$cache"
+          if [ ! -x "$target/bin/node" ]; then
+            test ! -e "$target"
+            temporary=$(mktemp -d "$cache/yuvomi-node-bootstrap.XXXXXX")
+            trap 'rm -rf -- "$temporary"' EXIT
+            curl --fail --location https://nodejs.org/dist/v22.22.1/node-v22.22.1-darwin-arm64.tar.gz -o "$temporary/node.tar.gz"
+            printf '%s  %s\n' 679ad4966339e4ef4900f57996714864e4211b898825bb840c3086c419fbcef2 "$temporary/node.tar.gz" | shasum -a 256 -c -
+            tar -xzf "$temporary/node.tar.gz" -C "$temporary"
+            mv "$temporary/node-v22.22.1-darwin-arm64" "$target"
+          fi
+          test "$("$target/bin/node" -p 'process.arch')" = arm64
+          echo "$target/bin" >> "$GITHUB_PATH"
+          "$target/bin/node" --version
       - uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262
         env:
           GIT_DEFAULT_HASH: sha256
@@ -29,7 +48,7 @@ jobs:
           bash scripts/install-xcodegen.sh "$YUVOMI_CI_TEMP/xcodegen"
           "$YUVOMI_CI_TEMP/xcodegen/xcodegen/bin/xcodegen" generate --spec ios/project.yml
           xcodebuild -version
-      - name: Portable URL policy tests and Swift syntax
+      - name: Portable native API/contract tests and Swift syntax
         run: |
           swift test --package-path ios --scratch-path "$YUVOMI_CI_TEMP/SwiftPolicy"
           swiftc -frontend -parse ios/Sources/*.swift ios/Tests/*.swift ios/UITests/*.swift