test: add packaged application E2E workflow

[kriszyp]

Summary

• build Harper with the same npm run package entry point used by releases
• verify and upload the generated npm tarball once for all downstream jobs
• install that artifact, deploy redirector and early-hints from their current main branches, and run their integration suites
• stage clean deployment copies without checkout metadata or node_modules, exercising Harper's server-side dependency installation
• run Harper's existing acl-connect MQTT integration coverage against the packaged runtime
• scope internal-repository checkout tokens to read-only access for only the selected application

Validation

• redirector: 65 passing from a clean staged deployment
• early-hints: 8 passing from a clean staged deployment
• acl-connect: 13 passing
• npm run test:unit:main: 3,783 passing, 188 pending
• npm run test:unit:resources: 1,251 passing, 14 pending
• npm run build
• npm run lint:required
• Prettier, actionlint, and git diff --check

The repository-wide integration command was also exercised for 16 minutes. It reached the non-gating qa-scratch defect-probe corpus and reproduced existing intentional/known failures, including zero-timeout probes, so it was stopped after the task-specific packaged-runtime suites had passed.

Attention

• redirector and early-hints intentionally track mutable downstream main, so a failure can represent compatibility drift on either side.
• their app-owned integration suites run with one Harper worker to match their immediate timing/state assumptions; Harper's integration matrix retains broader multi-worker coverage.
• acl-connect currently has no downstream integration suite; this uses the published 1.0.10 package through Harper's existing MQTT ACL integration test.
• fork pull requests build and inspect the Harper package but skip the two internal-repository jobs because org secrets are unavailable.
• cross-model coverage: Gemini and Harper-domain review passed; the review's GitHub App token-scoping blocker was fixed and the final artifact re-reviewed with no remaining findings.

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[claude]

Reviewed; no blockers found.