test: verify packaged WorkDSH plugin inventory

docs/desktop-boundaries.md

@@ -48,5 +48,7 @@ browser, identity, access, and audit behavior. A source-level package count or
 successful config dump alone does not prove that runtime outcome.
 Profile preparation now boots the bundled DSH plugin manager and requires its
 `listBundles()` response to contain exactly the five installed and enabled
-WorkDSH products. The installed application's UI and feature flows still need
-their own acceptance checks on both platforms.
+WorkDSH products. The Electron `afterPack` gate repeats that live inventory
+check with the Node executable and Profile inside each packaged application.
+The installed application's UI and feature flows still need their own
+acceptance checks on both platforms.

dsh-plugin-desktop/scripts/verify-workdsh-carrier.ts

@@ -1,6 +1,8 @@
 /** Verify that the Electron carrier contains no second Harness runtime. */
 import { existsSync, readFileSync, readdirSync } from 'node:fs'
+import { spawnSync } from 'node:child_process'
 import { join } from 'node:path'
+import { fileURLToPath } from 'node:url'
 import { extractFile, listPackage } from '@electron/asar'
 import { DSH_VERSION } from './runtime-version.mjs'
 
@@ -94,6 +96,17 @@ export async function afterPack(context: PackContext): Promise<void> {
       throw new Error(`Bundled ${name} is ${String(pkg.version)}, expected ${DSH_VERSION}`)
     }
   }
+  const node = join(runtime, 'primary-runtime', 'dependencies', 'node', 'bin',
+    context.electronPlatformName === 'win32' ? 'node.exe' : 'node')
+  const inventoryCheck = fileURLToPath(new URL('./verify-product-plugin-inventory.mjs', import.meta.url))
+  const inventory = spawnSync(node, [inventoryCheck, runtime], {
+    encoding: 'utf8',
+    timeout: 120_000,
+  })
+  if (inventory.error || inventory.status !== 0) {
+    throw new Error(`Packaged WorkDSH plugin inventory check failed: ${String(inventory.error ?? inventory.stderr)}`)
+  }
+  process.stdout.write(inventory.stdout)
   console.log(`Verified thin Electron carrier and ${names.length} Harness ${DSH_VERSION} packages`)
 }