test: platform lanes after the main merge

- test_windows_build_deps: the fixture Get-Command knows link.exe (MSVC linker
  pin) and asserts the pin; real PowerShell children on a cold runner exceed 30s
- test_runtime sealed worker: symlink the interpreter instead of copying it so
  a framework build still finds its stdlib (macOS)
- test_code_execution_modes: compare realpaths (/var/tmp vs /private/var/tmp)
- test_post_update_expose_cli: --help reaches the boot bootstrap; --version is
  answered on the pre-import fast path and never exposes shims

tests/hermes_cli/test_post_update_expose_cli.py

@@ -245,7 +245,9 @@ def test_direct_packaged_cli_exposes_shims_before_electron(tmp_path):
     env = dict(os.environ, HOME=str(home), HERMES_HOME=str(home / ".hermes"),
                HERMES_INSTALL_ROOT=str(repo), HERMES_RUNTIME_DIR=str(tmp_path / "tools"))
     # Execute the package CLI directly. No Electron process or linking helper runs.
-    result = subprocess.run([str(bin_dir / "hermes"), "--version"], env=env,
+    # `--help` reaches main()'s boot bootstrap (which owns expose_cli) before argparse
+    # exits; `--version` is answered on the pre-import fast path and never gets there.
+    result = subprocess.run([str(bin_dir / "hermes"), "--help"], env=env,
                             capture_output=True, text=True, timeout=30, encoding="utf-8")
     assert result.returncode == 0, result.stderr
     for name in ("hermes", "hermes-agent", "hermes-acp"):

tests/pm/test_runtime.py

@@ -118,7 +118,10 @@ def test_sealed_worker_command_uses_only_its_recorded_site(tmp_path, monkeypatch
     else:
         base.mkdir()
         python = base / "python"
-        shutil.copy2(Path(sys._base_executable).resolve(), python)
+        # A symlink, not a copy: a lone copied binary cannot find its stdlib on a
+        # framework-style build (macOS: "Could not find platform independent libraries").
+        # The contract under test is the sealed sys.path, not the binary's location.
+        python.symlink_to(Path(sys._base_executable).resolve())
     (runtime / "pm-runtime.json").write_text(json.dumps({
         "python": "../python/" + python.name, "sitePackages": "site",
     }))

tests/pm/test_windows_build_deps.py

@@ -25,7 +25,7 @@ def _powershell(script, *args, env=None):
     return subprocess.run(
         [shell, "-NoProfile", "-NonInteractive", "-ExecutionPolicy", "Bypass",
          "-File", str(script), *map(str, args)],
-        capture_output=True, text=True, encoding="utf-8", errors="replace", env=env, timeout=30,
+        capture_output=True, text=True, encoding="utf-8", errors="replace", env=env, timeout=180,
     )
 
 
@@ -158,6 +158,9 @@ function Get-Command {
     param([string]$Name)
     switch ($Name) {
         'cl.exe' { return [pscustomobject]@{Source = (Join-Path $vs 'cl.exe')} }
+        # The MSVC linker pin (CARGO_TARGET_AARCH64_PC_WINDOWS_MSVC_LINKER) resolves link.exe;
+        # a path under \MSVC\ is what the helper accepts.
+        'link.exe' { return [pscustomobject]@{Source = (Join-Path $vs 'VC\Tools\MSVC\14.44\bin\HostARM64\ARM64\link.exe')} }
         'rustup.exe' { return [pscustomobject]@{Source = (Join-Path $Root 'rustup.exe')} }
         'rustc.exe' { return [pscustomobject]@{Source = $rustcPath} }
         'vcpkg.exe' { return $null }
@@ -190,6 +193,7 @@ if ($env:PATH -ne $expectedPath) { throw 'PATH lost or reordered' }
 if ($env:OPENSSL_DIR -ne $prefix -or $env:OPENSSL_STATIC -ne '1') { throw 'Wrong OpenSSL tree' }
 if ($env:INCLUDE -ne 'fixture SDK include' -or $env:LIB -ne 'fixture SDK lib') { throw 'SDK environment lost' }
 if ($env:CC_aarch64_pc_windows_msvc -ne (Join-Path $vs 'clang.exe')) { throw 'Compiler lost' }
+if ($env:CARGO_TARGET_AARCH64_PC_WINDOWS_MSVC_LINKER -notlike '*\MSVC\*link.exe') { throw 'MSVC linker not pinned' }
 # CI initializes once, desktop again, then its native staging child a third time.
 # Re-running VsDevCmd grows PATH until cmd.exe hits its 8191-character limit.
 $prepared = @{}

tests/tools/test_code_execution_modes.py

@@ -64,7 +64,11 @@ print(json.dumps({{
     expected_cwd = child_env if mode == "project" else Path(result["staging"])
     assert Path(result["cwd"]).resolve() == expected_cwd.resolve()
     controlled = [result["staging"]] + ([str(repo)] if mode == "strict" else [])
-    assert list(map(os.path.normcase, result["pythonpath"])) == list(map(os.path.normcase, controlled + [str(user_lib)] * 2))
+    # macOS: the staging dir is minted under /var/tmp (a symlink to /private/var/tmp) and
+    # `hermes_tools.__file__` reports the resolved path, so compare realpaths.
+    def _canon(path: str) -> str:
+        return os.path.normcase(os.path.realpath(path))
+    assert list(map(_canon, result["pythonpath"])) == list(map(_canon, controlled + [str(user_lib)] * 2))
     assert dict(os.environ) == before