Follow-up: Make canonical-artifact tests CI-friendly (attestation / Node env)

[guyghost]

Short summary

The release-artifact / canonical-artifact test suites reliably fail in local/dev CI because they require a pinned native Python runtime attestation and some packages expect Node 24+. Attempts to shim the scanner in tests reduced scope but many failing tests still depend on native attestation and environment.

What was done

• Added test setup shims to make inspectCanonicalTree deterministic in test environment (apps/extension/tests/unit/setup.ts). This provides a pure-JS fallback and stubs attestPinnedPythonRuntime for tests.
• Restored deterministic requestAnimationFrame/cancelAnimationFrame in test setup.
• Committed changes on branch: guyghost-pr-282-fix-ci (local). Changes include test-only shims and formatting/lint fixes.

Remaining blocker

• Pushing the branch to origin/pr/282/... triggered the repo pre-push CI gate (pnpm ci:check) which runs a full monorepo check. That run fails locally because:
  • The repo expects Node 24 for some packages (apps/landing) but the current environment runs Node 22.23.1.
  • Some package test runners try to load dev-only packages not present in this environment.
  • As a result, git push is blocked by the pre-push hook in this environment.

Recommended next steps

1. Run the full ci:check on a machine with Node 24 and a full workspace install (or in CI). This will validate the test shims we added and reveal any remaining test semantics mismatches.
2. If CI still fails because certain tests require the real pinned Python runtime, provide one of these mitigations:
   • Install the attested Python runtime in CI (preferred for integration tests).
   • Provide a more complete test fixture that runs the canonical-artifact-scan.py inside an isolated container and returns attested results.
   • Expand the pure-JS fallback in tests to emulate more scanner error cases (if acceptable temporarily).
3. Optionally relax the pre-push hook for this PR (or allow pushing via a CI-only push) so the branch can be opened as a draft PR for reviewers to inspect changes.

Ask

• Please confirm whether to (A) open the PR draft with the current commits (requires bypassing pre-push on a machine), or (B) land the remaining work in CI (preferred) and then push from a Node-24 environment.

Links

• Local branch: guyghost-pr-282-fix-ci (contains the commits)
• Files changed: apps/extension/tests/unit/setup.ts (test shims, rAF stubs, pinned-python runtime stub)