ci: macOS gate tolerates the runner's missing WebGL; add verify-cloak

The firefox-10 build gated green on all 5 targets but both macOS gate legs
failed. The cloak/webgl guards hard-required a live WebGL context, and macOS
GitHub runners expose none in the CI session (no software-GL fallback, unlike
Linux llvmpipe and Windows WARP). The cloak renders fine there anyway, which the
non-blank screenshot proves, so on the mac legs the WebGL-present check now
self-skips and the cocoa cloak is validated via the screenshot plus CGWindowAlpha.
The gamma masking guard skips on mac too (platform-agnostic C++, covered on Linux
and Windows).

verify-cloak.yml re-runs these guards against a prior build run's artifacts with
no rebuild, so a test-only fix like this is validated against the real binaries
in minutes instead of a 3h rebuild.

tests/test_cloak.py

@@ -91,9 +91,18 @@ def test_cloak_hides_window_but_keeps_rendering(firefox_binary):
         shot = page.screenshot()
         assert len(shot) > 3000, "cloaked window produced a blank screenshot (rendering paused)"
 
-        # 2) real WebGL present (native headless has none) -> headed pipeline intact.
+        # 2) headed pipeline intact: a real WebGL context (Playwright's native
+        #    headless has none). Linux (Xvfb + llvmpipe) and Windows (WARP) give a
+        #    software context on the GPU-less runners, so a missing context there
+        #    is a real regression -> hard fail. macOS GitHub runners expose NO
+        #    WebGL in the CI session at all (even vanilla Firefox), and macOS has
+        #    no software-GL fallback; the cloak's "still rendering" property is
+        #    already proven by the non-blank screenshot above, so we don't also
+        #    require a live WebGL context there.
         renderer = page.evaluate(_WEBGL_RENDERER)
-        assert renderer and renderer != "NO-WEBGL", f"no real WebGL under cloak: {renderer!r}"
+        webgl_ok = bool(renderer) and renderer != "NO-WEBGL"
+        if not (sys.platform == "darwin" and not webgl_ok):
+            assert webgl_ok, f"no real WebGL under cloak: {renderer!r}"
 
         # 3) the window is actually hidden (per-platform).
         if sys.platform == "win32":

tests/test_fingerprint_surface.py

@@ -27,6 +27,7 @@ Run only this file:
 from __future__ import annotations
 
 import re
+import sys
 
 import pytest
 
@@ -296,6 +297,12 @@ def test_webgl_readpixels_no_masking_signature(page):
     ~300+ 'spikes' and pixelscan flagged it as masking; the gamma remap leaves
     the gradient smooth (~0 spikes). Regression guard for the gamma fix."""
     res = _ev(page, _WEBGL_MASKING_PROBE)
+    if res.get("error") == "no-webgl" and sys.platform == "darwin":
+        pytest.skip(
+            "macOS CI runners expose no WebGL (no software-GL fallback); the gamma "
+            "readPixels remap is platform-agnostic C++ and is exercised by the Linux "
+            "(Xvfb/llvmpipe) and Windows (WARP) gates."
+        )
     assert "error" not in res, f"WebGL probe failed: {res}"
     # genuine / gamma -> ~0; the rejected +-1 algorithm produced ~320.
     assert res["spikes"] < 30, (