feat(authz): introduce centralized proxy-based authz pipeline and lifecycle policy (#1632)

Integrated into release/v3.7.2

scripts/smoke-electron-packaged.mjs

@@ -323,12 +323,22 @@ export function buildSmokeEnv({
     smokeEnv.TMPDIR ||= join(dataDir, "tmp");
   }
 
-  return {
+  const baseEnv = {
     ...smokeEnv,
     DATA_DIR: dataDir,
     ELECTRON_ENABLE_LOGGING: "1",
     ELECTRON_ENABLE_STACK_DUMPING: "1",
   };
+
+  // CI environments need sandbox disabled (GitHub Actions runners
+  // cannot configure SUID chrome-sandbox on Linux, and Windows
+  // runners may exit silently without it).
+  if (parentEnv.CI) {
+    baseEnv.CI = parentEnv.CI;
+    baseEnv.ELECTRON_DISABLE_SANDBOX = "1";
+  }
+
+  return baseEnv;
 }
 
 function isInsideDir(parentDir, candidateDir) {
@@ -357,6 +367,15 @@ async function ensureSmokeEnvDirs(smokeEnv, dataDir) {
     ),
   ];
 
+  // On Windows, Electron derives its userData from APPDATA/<productName>.
+  // requestSingleInstanceLock() runs synchronously at module load and
+  // fails silently if the directory doesn't exist yet — causing exit(0).
+  if (platform() === "win32" && smokeEnv.APPDATA) {
+    for (const subdir of ["omniroute-desktop", "OmniRoute", "omniroute"]) {
+      dirs.push(join(smokeEnv.APPDATA, subdir));
+    }
+  }
+
   await Promise.all(dirs.map((dir) => mkdir(dir, { recursive: true })));
 }
 
@@ -398,13 +417,25 @@ async function main() {
   await assertPortIsFree(smokeUrl);
   await ensureSmokeEnvDirs(smokeEnv, dataDir);
 
+  // ── CI sandbox workaround ──────────────────────────────────
+  // GitHub Actions runners cannot set SUID on chrome-sandbox (Linux)
+  // and Windows runners may fail silently without --no-sandbox.
+  const spawnArgs = [];
+  if (process.env.CI) {
+    spawnArgs.push("--no-sandbox", "--disable-gpu");
+    if (platform() === "linux") {
+      spawnArgs.push("--disable-dev-shm-usage");
+    }
+  }
+
   console.log(`[electron-smoke] launching ${appExecutable}`);
+  if (spawnArgs.length) console.log(`[electron-smoke] CI args: ${spawnArgs.join(" ")}`);
   console.log(`[electron-smoke] DATA_DIR=${dataDir}`);
   console.log(`[electron-smoke] waiting for ${smokeUrl}`);
 
   const logs = { value: "" };
   const streamLogs = process.env.ELECTRON_SMOKE_STREAM_LOGS === "1";
-  const child = spawn(appExecutable, [], {
+  const child = spawn(appExecutable, spawnArgs, {
     detached: platform() !== "win32",
     env: smokeEnv,
     stdio: ["ignore", "pipe", "pipe"],