feat(ci): Windows leg for Electron prepare smoke (WS1.5) (#7113)

The Electron rebuild/spawn path executed for the FIRST time on the release tag:
the v3.8.48 Windows failure (npx.cmd spawned without shell) could only surface
at release. The Electron Package Smoke job becomes a 2-leg matrix: ubuntu keeps
the full pack + headless smoke; windows-latest runs prepare:bundle — the exact
ABI rebuild + spawn-plan path that broke — on every release PR instead of tag
day. tar extraction of the build artifact works on windows-latest (bsdtar).
Workflow-only change; YAML parse validated.

.github/workflows/ci.yml

@@ -617,10 +617,19 @@ jobs:
         run: npm run check:pack-boot
 
   electron-package-smoke:
-    name: Electron Package Smoke
-    runs-on: ubuntu-latest
-    timeout-minutes: 25
+    name: Electron Package Smoke (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
     needs: build
+    # WS1.5 (v3.8.49 plan): the Electron rebuild/spawn path previously executed for
+    # the FIRST time on the release tag — the v3.8.48 Windows bug (npx.cmd spawned
+    # without shell, CVE-2024-27980 behavior change) could only surface at release.
+    # windows-latest runs prepare:bundle (the ABI rebuild + spawn plan) per release
+    # PR; ubuntu keeps the full pack + headless smoke.
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest]
     env:
       JWT_SECRET: ci-build-secret-with-sufficient-length-for-validation
       CSC_IDENTITY_AUTO_DISCOVERY: "false"
@@ -646,9 +655,15 @@ jobs:
         working-directory: electron
         run: npm install --no-audit --no-fund
       - name: Pack Electron app
+        if: runner.os == 'Linux'
         working-directory: electron
         run: npm run pack
+      - name: Prepare Electron standalone (Windows ABI rebuild + spawn path)
+        if: runner.os == 'Windows'
+        working-directory: electron
+        run: npm run prepare:bundle
       - name: Smoke packaged Electron app
+        if: runner.os == 'Linux'
         env:
           ELECTRON_SMOKE_TIMEOUT_MS: 60000
         run: xvfb-run -a npm run electron:smoke:packaged

changelog.d/maintenance/electron-win-prepare-smoke.md

@@ -0,0 +1 @@
+- **CI**: the Electron Package Smoke job now runs a Windows leg that executes `prepare:bundle` (the native ABI rebuild + spawn plan) per release PR — the v3.8.48 Windows bug (`npx.cmd` spawned without shell) could previously only surface on the release tag, its first-ever execution