ci: macOS gate tolerates the runner's missing WebGL; add verify-cloak

The firefox-10 build gated green on all 5 targets but both macOS gate legs
failed. The cloak/webgl guards hard-required a live WebGL context, and macOS
GitHub runners expose none in the CI session (no software-GL fallback, unlike
Linux llvmpipe and Windows WARP). The cloak renders fine there anyway, which the
non-blank screenshot proves, so on the mac legs the WebGL-present check now
self-skips and the cocoa cloak is validated via the screenshot plus CGWindowAlpha.
The gamma masking guard skips on mac too (platform-agnostic C++, covered on Linux
and Windows).

verify-cloak.yml re-runs these guards against a prior build run's artifacts with
no rebuild, so a test-only fix like this is validated against the real binaries
in minutes instead of a 3h rebuild.

tests/test_fingerprint_surface.py

@@ -27,6 +27,7 @@ Run only this file:
 from __future__ import annotations
 
 import re
+import sys
 
 import pytest
 
@@ -296,6 +297,12 @@ def test_webgl_readpixels_no_masking_signature(page):
     ~300+ 'spikes' and pixelscan flagged it as masking; the gamma remap leaves
     the gradient smooth (~0 spikes). Regression guard for the gamma fix."""
     res = _ev(page, _WEBGL_MASKING_PROBE)
+    if res.get("error") == "no-webgl" and sys.platform == "darwin":
+        pytest.skip(
+            "macOS CI runners expose no WebGL (no software-GL fallback); the gamma "
+            "readPixels remap is platform-agnostic C++ and is exercised by the Linux "
+            "(Xvfb/llvmpipe) and Windows (WARP) gates."
+        )
     assert "error" not in res, f"WebGL probe failed: {res}"
     # genuine / gamma -> ~0; the rejected +-1 algorithm produced ~320.
     assert res["spikes"] < 30, (