ci: collect native APK and screenshot evidence on Gitea

Bootstrap checksum-pinned ARM64 Node before Mac checkout, upload a dedicated installable native debug APK, collect AGP test output before UTP uninstall and reject stale/missing screenshots. Add five screenshot-output regressions and enforce native shipping-source invariants. Workflow lint, 10 runner and 8 JUnit verifier regressions pass; remote execution is not yet verified.

scripts/test-integration.py

@@ -22,6 +22,25 @@ ROOT = Path(__file__).resolve().parents[1]
 REVISION = "10bfef7686ed7303b4c74c7fcc55a5eb16356c9d"
 
 
+def prepare_android_screenshots(app_output):
+    additional = app_output / "connected_android_test_additional_output/integrationAndroidTest"
+    screenshots = app_output / "native-screenshots"
+    # Never accept a previous run's screenshot as current evidence.
+    for stale in additional.rglob("native-dashboard.png"):
+        stale.unlink()
+    (screenshots / "native-dashboard.png").unlink(missing_ok=True)
+    return additional, screenshots
+
+
+def collect_native_screenshot(additional, screenshots):
+    captures = list(additional.rglob("native-dashboard.png"))
+    assert len(captures) == 1, "Missing or ambiguous native fixture screenshot"
+    capture = captures[0].read_bytes()
+    assert capture.startswith(b"\x89PNG\r\n\x1a\n"), "Invalid native fixture screenshot"
+    screenshots.mkdir(parents=True, exist_ok=True)
+    (screenshots / "native-dashboard.png").write_bytes(capture)
+
+
 def run(upstream, android):
     revision = subprocess.check_output(["git", "-C", str(upstream), "rev-parse", "HEAD"], text=True).strip()
     assert revision == REVISION, f"Expected pinned upstream {REVISION}, got {revision}"
@@ -120,18 +139,19 @@ def run(upstream, android):
                     subprocess.run([str(adb), "reverse", f"tcp:{port}", f"tcp:{port}"], check=True)
                     subprocess.run([str(adb), "reverse", f"tcp:{ready['idpPort']}", f"tcp:{ready['idpPort']}"], check=True)
                     try:
+                        app_output = (Path(env["YUVOMI_BUILD_DIR"]) / "app" if "YUVOMI_BUILD_DIR" in env
+                                      else ROOT / "android/app/build") / "outputs"
+                        additional, screenshots = prepare_android_screenshots(app_output)
                         # The ephemeral password is passed through the local test runner only,
                         # never written into a source file or printed by this harness.
                         result = subprocess.run(["bash", str(ROOT / "android/gradlew"), "-p", str(ROOT / "android"),
                             "-Pintegration", "connectedIntegrationAndroidTest"], env=env, check=False)
                         if result.returncode:
                             raise RuntimeError("Android integration tests failed. Inspect the Gradle test report.")
-                        output = Path(env.get("YUVOMI_BUILD_DIR", ROOT / "android"))
-                        reports = output / "app/outputs/androidTest-results/connected/integration"
-                        if "YUVOMI_BUILD_DIR" not in env:
-                            reports = ROOT / "android/app/build/outputs/androidTest-results/connected/integration"
+                        reports = app_output / "androidTest-results/connected/integration"
                         subprocess.run(["python3", str(ROOT / "scripts/verify-test-results.py"),
                                         str(reports), "--minimum", "7"], check=True)
+                        collect_native_screenshot(additional, screenshots)
                     finally:
                         subprocess.run([str(adb), "reverse", "--remove", f"tcp:{port}"], check=False)
                         subprocess.run([str(adb), "reverse", "--remove", f"tcp:{ready['idpPort']}"], check=False)