[ORESoftware]

Purpose

Add alternate-generation runner coverage for the exact immutable source-render package while the Ubuntu 24.04 and macOS 15 pools are saturated.

Immutable inputs

zed-pkg-test/zed-pkg-e2e@153d65ad2b3cf5fc139efb0dbdf29fa816ce55d2
ORESoftware/k8s-cluster@0c71eed05f8be50ac22ebe73715ded4a871234a8
daedalus-fab/fabrication-server.rs@cea4a3c772012e1f2f87050bac24e911b8e2e577

Ubuntu 22.04 and macOS 14 execute the exact owner endpoint/NetworkPolicy tests, the independent test-org parity implementation, checksum-pinned Kustomize installation, catalog/gitlink/source provenance checks, deterministic double render, namespace/resource restrictions, and pristine-checkout assertions.

This expands operating-system generation coverage rather than replacing the Ubuntu 24.04/macOS 15/Windows 2025 matrices in zed-pkg-e2e#155 and security-adversarial-e2e#8.

All checkouts are read-only with persisted credentials disabled. No private-repository token, PAT, deployment, publication, Kubernetes/Argo mutation, Cloudflare/DNS/R2 operation, or production credential is used.

Coordination

• Primary package: test(DEN-2724): render checksum-pinned private source on three platforms zed-pkg-e2e#155
• Modern-runner reproduction: test(DEN-2724): independently reproduce the exact source render #8
• Owner source repair: https://github.com/daedalus-fab/fabrication-server.rs/pull/11
• Stacked cluster pin: chore(DEN-2724): pin fabrication OTLP egress repair ORESoftware/k8s-cluster#1211
• Linear: DEN-2724 and DEN-630

[linear-code]

DEN-2724

[ORESoftware]

Alternate-generation matrix is green

Run 31280074691 passed on both Ubuntu 22.04 and macOS 14 ARM64 against the exact immutable test package and cluster/source pair:

zed-pkg-test/zed-pkg-e2e@153d65ad2b3cf5fc139efb0dbdf29fa816ce55d2
ORESoftware/k8s-cluster@0c71eed05f8be50ac22ebe73715ded4a871234a8
daedalus-fab/fabrication-server.rs@cea4a3c772012e1f2f87050bac24e911b8e2e577

Both runners passed exact checkout identity, the owner-repo endpoint/NetworkPolicy unit suite, the independent parity implementation, official Kustomize v5.8.1 asset verification, catalog/gitlink/source provenance, deterministic double render, namespace/resource restrictions, and pristine-checkout verification.

Linux and macOS produced the same evidence as Windows Server 2025:

render SHA-256: 440b6306c5306a6aef01c83f96cb3a00eb2b42c38be78aebf9ef1e4682920415
render bytes:   4745
resources:      4
source blobs:   7
endpoints:      NATS 4222, OTLP HTTP 4318
allowed TCP:    53, 4222, 4318, 8113

Artifact archive digests:

Linux X64:   sha256:a41fbd23d6d802f80dc955f9b69ea24557109c51dc59ed56f60205a7c2b398ff
macOS ARM64: sha256:76618089317f20dccad71e3ba34906ef357d20ca1ee642497187cb15c6d5ca46

This PR is ready for review. It performs no private repository checkout, deployment, publication, or cloud/cluster mutation.