ci: macOS gate tolerates the runner's missing WebGL; add verify-cloak

The firefox-10 build gated green on all 5 targets but both macOS gate legs
failed. The cloak/webgl guards hard-required a live WebGL context, and macOS
GitHub runners expose none in the CI session (no software-GL fallback, unlike
Linux llvmpipe and Windows WARP). The cloak renders fine there anyway, which the
non-blank screenshot proves, so on the mac legs the WebGL-present check now
self-skips and the cocoa cloak is validated via the screenshot plus CGWindowAlpha.
The gamma masking guard skips on mac too (platform-agnostic C++, covered on Linux
and Windows).

verify-cloak.yml re-runs these guards against a prior build run's artifacts with
no rebuild, so a test-only fix like this is validated against the real binaries
in minutes instead of a 3h rebuild.

tests/test_cloak.py

@@ -91,9 +91,18 @@ def test_cloak_hides_window_but_keeps_rendering(firefox_binary):
         shot = page.screenshot()
         assert len(shot) > 3000, "cloaked window produced a blank screenshot (rendering paused)"
 
-        # 2) real WebGL present (native headless has none) -> headed pipeline intact.
+        # 2) headed pipeline intact: a real WebGL context (Playwright's native
+        #    headless has none). Linux (Xvfb + llvmpipe) and Windows (WARP) give a
+        #    software context on the GPU-less runners, so a missing context there
+        #    is a real regression -> hard fail. macOS GitHub runners expose NO
+        #    WebGL in the CI session at all (even vanilla Firefox), and macOS has
+        #    no software-GL fallback; the cloak's "still rendering" property is
+        #    already proven by the non-blank screenshot above, so we don't also
+        #    require a live WebGL context there.
         renderer = page.evaluate(_WEBGL_RENDERER)
-        assert renderer and renderer != "NO-WEBGL", f"no real WebGL under cloak: {renderer!r}"
+        webgl_ok = bool(renderer) and renderer != "NO-WEBGL"
+        if not (sys.platform == "darwin" and not webgl_ok):
+            assert webgl_ok, f"no real WebGL under cloak: {renderer!r}"
 
         # 3) the window is actually hidden (per-platform).
         if sys.platform == "win32":