test(distribution): verify native channel installs

[e54-bot]

Summary

• add one shared direct-native post-install smoke for version, representative compile/check, and optional clean first-party OPY provider bootstrap
• validate the real install.sh/install.ps1 and local/generated Homebrew, Scoop, and WinGet channels against locally staged canonical-shaped artifacts
• reuse the smoke for every extracted release target and document the verified distribution surface

Verification

• python3 scripts/verify-dist.py
• scripts/test-install.sh
• python3 scripts/test-distribution.py (macOS: install.sh and a local Homebrew tap)
• cargo fmt --all -- --check
• cargo clippy --locked --workspace --all-targets --all-features -- -D warnings
• cargo test --locked --workspace --all-targets --all-features
• Python, YAML, shell, actionlint, and diff checks

Provider bootstrap was attempted locally but was limited by the host TLS UnknownIssuer error; the failure remains visible as a native-runtime failure.

Fixes #255

[Teakowa]

Blocker — the Windows distribution path is not self-contained. scripts/test-distribution.py requires Scoop, but .github/workflows/ci.yml does not provision it; the current windows-latest job fails at scoop bucket add with FileNotFoundError, so Scoop is not exercised and WinGet is never reached. The WinGet path also invokes a local manifest install without enabling LocalManifestFiles, which WinGet requires for that flow. Provision/configure the required Windows package-manager tooling before running the channel smoke, then rerun so both Scoop and WinGet complete their real install path and shared native smoke.

[Teakowa]

Blocker — the Windows path still does not reach Scoop/WinGet installation. Scoop provisioning now succeeds, but scripts/test-distribution.py launches scoop directly via Python subprocess.run, which uses CreateProcess and cannot resolve Scoop's PowerShell command/script form; the job again fails at scoop bucket add with FileNotFoundError, and the cleanup path fails the same way. Invoke Scoop through an executable command path PowerShell/Pwsh can resolve (or otherwise resolve a directly executable command for Python), then rerun so Scoop completes and WinGet is actually exercised.

[Teakowa]

Major — the Windows distribution validation model should be reworked to match the updated #255 contract: each installation channel is an independent user scenario/CI leg with only its own prerequisites. Do not make one Windows path provision and exercise install.ps1 + Scoop + WinGet together, and do not keep an all-in-one cross-platform/package-manager orchestrator just to unify invocation. Validate install.ps1, Scoop, and WinGet separately through their native channel environment, then run the same native Wright smoke against the binaries each channel installed.

[Teakowa]

Blocker — scripts/test-distribution-scoop.py passes the generated bucket’s raw Windows filesystem path to scoop bucket add, but Scoop requires a Git repository URI; the current Scoop leg fails before installation, so the required real Scoop install + native smoke never runs. Expose the local bucket through a Scoop-accepted cloneable Git URI and rerun through install + shared smoke.

Blocker — the WinGet leg stops at winget validate: the generated manifests emit validation warnings (Scope unsupported for the portable installer and missing schema headers), which WinGet reports as APPINSTALLER_CLI_ERROR_MANIFEST_VALIDATION_WARNING. Fix the generated WinGet metadata so validation succeeds cleanly rather than suppressing/ignoring warnings, then rerun the real install + shared native smoke.

[Teakowa]

Blocker — the Scoop path is fixed, but WinGet still does not reach installation. Removing the unsupported portable Scope resolved that warning, but all three generated WinGet manifests now fail winget validate with The schema header URL does not match the expected pattern, so the command exits with APPINSTALLER_CLI_ERROR_MANIFEST_VALIDATION_WARNING before winget install or the native smoke runs. Generate schema headers that the WinGet client used by this validation leg accepts (or use a compatible manifest schema/version), then rerun until the WinGet install and shared native smoke complete without suppressing validation warnings.

[Teakowa]

LGTM