fix(ci): the macos runner has no Hypervisor.framework

Hosted macOS runners run without nested virtualization: kern
.hv_support is 0 and no binary can boot a VM there, entitlement or
not. The macos job keeps the full compile gate and asserts the probe
reports the known HVF absence with a working engine load, so any
other regression still fails; the boot e2e stays on Linux and real
Macs.

.github/workflows/ci.yml

@@ -39,7 +39,7 @@ jobs:
         run: cargo test
 
   macos:
-    name: macos — fmt, clippy, test, boot
+    name: macos — fmt, clippy, test, probe
     runs-on: macos-26
     timeout-minutes: 45
     steps:
@@ -78,15 +78,19 @@ jobs:
       - name: Sign the binary with the hypervisor entitlement
         run: codesign --force --sign - --entitlements packaging/homebrew/ecrou.entitlements target/release/ecrou
 
+      # GitHub's macOS runners expose no Hypervisor.framework (they run
+      # without nested virtualization), so nothing boots here — the
+      # boot e2e lives on Linux (the snap e2e) and on real Macs. The
+      # probe must still behave: the engine loads from the krun tap,
+      # the tools are found, and the HVF absence is reported as that.
       - name: Probe
-        run: ./target/release/ecrou probe
-
-      - name: Boot alpine
         run: |
           set -euo pipefail
-          guest="$(./target/release/ecrou run --quiet alpine -- uname -r | tail -n 1)"
-          echo "guest kernel: $guest"
-          test -n "$guest"
+          out="$(./target/release/ecrou probe || true)"
+          printf '%s\n' "$out"
+          grep -q "libkrun:      ok" <<<"$out"
+          grep -q "e2fsprogs:    ok" <<<"$out"
+          grep -q "no Hypervisor.framework support" <<<"$out"
 
   t6:
     name: T6 strace audit

SPEC.md

@@ -328,8 +328,12 @@ unpacks the rootfs to a tree and lets mke2fs populate from the
 directory — slower, and run states it in the log. The T6 strace audit
 and the `/dev/kvm` gating stay Linux-only: strace does not exist on
 macOS and the hypervisor gate is the entitlement probe instead. CI
-runs the whole gate plus a real `ecrou run` boot on a `macos-26`
-runner; the release workflow ships a signed darwin-arm64 tarball.
+runs the whole gate on a `macos-26` runner; hosted macOS runners
+expose no Hypervisor.framework, so the boot e2e is the Linux snap
+e2e and any real Mac — CI only asserts that the probe loads the
+engine from the krun tap and reports the HVF absence. The release
+workflow ships a signed darwin-arm64 tarball (build and sign only,
+no boot).
 
 ## Homebrew