chore(ci): gate a stable release on the linux browser suites

the windows playwright legs still fail on dev pushes often enough that a
release gate over them would stall shipping. unit tests and builds still cover
both OSes, and dev pushes and nightly runs still cover the windows browser
legs.

.github/workflows/check-test.yml

@@ -1,8 +1,8 @@
 name: check-test
 
 # Pull requests run the fast tier: the affected unit tests on Linux. The full tier — unit tests on Windows, the
-# compiled builds, and the Playwright suites on both OSes — runs on pushes to dev and beta, on nightly and manual
-# runs, and as the gate release.yml calls before it publishes a stable release.
+# compiled builds, and the Playwright suites on both OSes — runs on pushes to dev and beta and on nightly and manual
+# runs. A stable release also runs it through release.yml's gate, with the browser suites on Linux only.
 on:
   push:
     branches:
@@ -22,6 +22,10 @@ on:
         description: Run only the quarantined browser tests (packages/app/e2e/QUARANTINE.md)
         type: boolean
         default: false
+      release_gate:
+        description: Run the browser suites on Linux only
+        type: boolean
+        default: false
 
 concurrency:
   # A new push to a pull request cancels its stale run. Every push and manual run keeps its own group, so each
@@ -224,12 +228,9 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        # Browser suites only run on pushes, nightly runs and the release gate, so every run covers both OSes.
-        settings:
-          - name: linux
-            host: blacksmith-4vcpu-ubuntu-2404
-          - name: windows
-            host: blacksmith-4vcpu-windows-2025
+        # The release gate runs the Linux browser suites only: the Windows legs still fail on dev pushes often
+        # enough that a stable release must not wait for them. Pushes and nightly runs cover Windows.
+        settings: ${{ fromJSON(inputs.release_gate && '[{"name":"linux","host":"blacksmith-4vcpu-ubuntu-2404"}]' || '[{"name":"linux","host":"blacksmith-4vcpu-ubuntu-2404"},{"name":"windows","host":"blacksmith-4vcpu-windows-2025"}]') }}
         quarantine: ${{ fromJSON(inputs.quarantine && '[true]' || '[false]') }}
         # Playwright splits whole spec files across shards by test count, not duration. Every app-N
         # entry must use the same total, and the entries must cover 1..total. The service worker suite

.github/workflows/release.yml

@@ -82,8 +82,8 @@ jobs:
   # ---- Gate: the full check suite, before anything is published ------------------------------------------------
 
   # release.yml does not wait for the check-test push run on the same commit, so a stable release would publish
-  # whatever that run later says. This gate runs the whole suite — unit tests on both OSes, the compiled builds
-  # and the browser suites — before any publish job below. Continuous dev and beta builds skip it: they publish
+  # whatever that run later says. This gate runs the whole suite — unit tests on both OSes, the compiled builds and
+  # the Linux browser suites — before any publish job below. Continuous dev and beta builds skip it: they publish
   # their own channel from a dev push, whose check-test run covers the same commit.
   verify:
     needs: plan
@@ -92,6 +92,8 @@ jobs:
       contents: read
       checks: write
     uses: ./.github/workflows/check-test.yml
+    with:
+      release_gate: true
 
   # A versioned release builds from a commit with its versions and changelog on the dispatched dev commit,
   # tagged v<version>. Runs git only.