fix(release): unbreak packaging workflow on all three platforms

- Bump electron-builder to 26.16.1 so macOS signing passes the temp keychain
  password to set-key-partition-list (upstream #10066), which the macOS 26
  runner image now enforces
- Stat asar entries with their native path in the package audit; splitting on
  path.sep made every nested file look missing on Windows
- Run the package smoke with --no-sandbox on Linux runners without a setuid
  chrome-sandbox
- Load the packaged stats dashboard over loopback HTTP in the smoke, matching
  how the app serves it since #263, and ignore Chromium's cache-only font probe

scripts/package-audit.cjs

@@ -51,10 +51,13 @@ function listFiles(root, prefix = '') {
   });
 }
 
+// asar resolves lookups with the platform separator, so stat with the listed
+// native path and only normalize the reported name.
 function listAppFiles(archive) {
   return asar.listPackage(archive).flatMap((entry) => {
-    const name = entry.replaceAll('\\', '/').replace(/^\//, '');
-    const stat = asar.statFile(archive, name);
+    const native = entry.replace(/^[\\/]/, '');
+    const stat = asar.statFile(archive, native);
+    const name = native.replaceAll('\\', '/');
     return 'size' in stat ? [{ path: name, bytes: stat.size }] : [];
   });
 }

scripts/package-audit.test.ts

@@ -134,10 +134,12 @@ test('archive inventory handles native files without counting them twice on disk
     mkdirSync(output);
     writeFileSync(path.join(input, 'main.js'), 'hello');
     writeFileSync(path.join(input, 'native.node'), 'native');
+    mkdirSync(path.join(input, 'dist', 'ai'), { recursive: true });
+    writeFileSync(path.join(input, 'dist', 'ai', 'client.js'), 'nested');
     const archive = path.join(output, 'app.asar');
     await createPackageFromStreams(
       archive,
-      ['main.js', 'native.node'].map((name) => ({
+      ['main.js', 'native.node', 'dist/ai/client.js'].map((name) => ({
         path: name,
         type: 'file',
         unpacked: name.endsWith('.node'),
@@ -148,6 +150,7 @@ test('archive inventory handles native files without counting them twice on disk
     assert.deepEqual(listAppFiles(archive), [
       { path: 'main.js', bytes: 5 },
       { path: 'native.node', bytes: 6 },
+      { path: 'dist/ai/client.js', bytes: 6 },
     ]);
     assert.equal(
       listFiles(output).reduce((sum: number, entry: { bytes: number }) => sum + entry.bytes, 0),

scripts/run-package-smoke.mjs

@@ -14,7 +14,12 @@ delete env.ELECTRON_RUN_AS_NODE;
 try {
   const result = spawnSync(
     require('electron'),
-    [fileURLToPath(new URL('./smoke-package.cjs', import.meta.url)), path.resolve(resources)],
+    [
+      fileURLToPath(new URL('./smoke-package.cjs', import.meta.url)),
+      path.resolve(resources),
+      // CI runners lack a setuid chrome-sandbox; this harness never loads remote content.
+      ...(process.platform === 'linux' ? ['--no-sandbox'] : []),
+    ],
     { env, stdio: 'inherit', timeout: 75_000 },
   );
   if (result.error) throw result.error;

scripts/smoke-package.cjs

@@ -1,6 +1,7 @@
 // Run with the pinned Electron runtime against a finished app's resources folder.
 const { app, BrowserWindow, session } = require('electron');
 const fs = require('node:fs');
+const http = require('node:http');
 const path = require('node:path');
 const { createRequire } = require('node:module');
 const assert = require('node:assert/strict');
@@ -21,6 +22,39 @@ const timeout = setTimeout(() => {
   app.exit(1);
 }, 60_000);
 
+const STATIC_TYPES = {
+  '.html': 'text/html',
+  '.js': 'text/javascript',
+  '.css': 'text/css',
+  '.png': 'image/png',
+  '.svg': 'image/svg+xml',
+  '.woff2': 'font/woff2',
+  '.ttf': 'font/ttf',
+  '.json': 'application/json',
+};
+
+// The stats dashboard is served by the stats HTTP server in the app, so load it
+// over loopback HTTP from the packaged stats/dist and treat missing static
+// assets as failures. API routes are not part of this smoke and may 404.
+function serveStatsDist(root, failedRequests) {
+  const server = http.createServer((req, res) => {
+    const pathname = new URL(req.url, 'http://127.0.0.1').pathname;
+    const relative = pathname === '/' ? 'index.html' : pathname.slice(1);
+    try {
+      const body = fs.readFileSync(path.join(root, relative));
+      res.writeHead(200, {
+        'Content-Type': STATIC_TYPES[path.extname(relative)] ?? 'application/octet-stream',
+      });
+      res.end(body);
+    } catch {
+      if (!pathname.startsWith('/api/')) failedRequests.push(`${req.url}: missing static asset`);
+      res.writeHead(404).end();
+    }
+  });
+  server.listen(0, '127.0.0.1');
+  return server;
+}
+
 async function smoke() {
   await app.whenReady();
   const packagedRequire = createRequire(path.join(archive, 'package.json'));
@@ -50,10 +84,17 @@ async function smoke() {
   );
   assert(extension.id, 'Yomitan extension failed to load');
   const failedRequests = [];
-  session.defaultSession.webRequest.onErrorOccurred({ urls: ['file://*/*'] }, (details) => {
-    if (details.error !== 'net::ERR_ABORTED')
-      failedRequests.push(`${details.url}: ${details.error}`);
-  });
+  session.defaultSession.webRequest.onErrorOccurred(
+    { urls: ['file://*/*', 'http://127.0.0.1/*'] },
+    (details) => {
+      // Chromium probes the cache before fetching @font-face fonts; an uncached
+      // font reports ERR_CACHE_MISS and is then fetched normally.
+      if (!['net::ERR_ABORTED', 'net::ERR_CACHE_MISS'].includes(details.error))
+        failedRequests.push(`${details.url}: ${details.error}`);
+    },
+  );
+  const statsServer = serveStatsDist(path.join(archive, 'stats', 'dist'), failedRequests);
+  await once(statsServer, 'listening');
   for (const ui of ['renderer', 'settings', 'syncui', 'stats']) {
     const win = new BrowserWindow({
       show: false,
@@ -63,10 +104,12 @@ async function smoke() {
       },
     });
     try {
-      await win.loadFile(
-        path.join(archive, ui === 'stats' ? 'stats/dist/index.html' : `dist/${ui}/index.html`),
-      );
-      if (ui !== 'stats') {
+      if (ui === 'stats') {
+        await win.loadURL(`http://127.0.0.1:${statsServer.address().port}/`);
+        // Let in-flight font requests settle before the window goes away.
+        await win.webContents.executeJavaScript('document.fonts.ready.then(() => true)');
+      } else {
+        await win.loadFile(path.join(archive, `dist/${ui}/index.html`));
         const loaded = await win.webContents.executeJavaScript(
           `document.fonts.load('400 16px "M PLUS 1"', '日本語').then(fonts => fonts.length > 0 && fonts.every(font => font.status === 'loaded'))`,
         );
@@ -76,6 +119,7 @@ async function smoke() {
       win.destroy();
     }
   }
+  statsServer.close();
   assert.deepEqual(failedRequests, [], 'Packaged UI resources failed to load');
   console.log(
     'Package smoke passed: SQLite, platform FFI, texthooker, Yomitan loading, UI pages, shared Japanese font.',