feat: add an optional simulator-only browser preview

.github/workflows/adversarial-review.yml

@@ -0,0 +1,45 @@
+name: Protected adversarial review evidence
+
+on:
+  pull_request_target:
+    types: [opened, synchronize, reopened]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: adversarial-review-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  evidence:
+    name: Base-owned adversarial review evidence
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out the protected base validator
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          ref: ${{ github.event.pull_request.base.sha }}
+          fetch-depth: 1
+          path: validator
+          persist-credentials: false
+      - name: Check out the read-only PR merge tree
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          ref: refs/pull/${{ github.event.pull_request.number }}/merge
+          fetch-depth: 0
+          path: candidate
+          persist-credentials: false
+      - name: Validate with code from the protected base
+        env:
+          REVIEW_BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          REVIEW_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          if [[ ! -f validator/scripts/check_adversarial_review.py ]]; then
+            echo "Base branch has not bootstrapped the adversarial-review validator yet."
+            exit 0
+          fi
+          python3 validator/scripts/check_adversarial_review.py \
+            --repository candidate \
+            --expected-base "$REVIEW_BASE_SHA" \
+            --expected-tip "$REVIEW_HEAD_SHA"

.github/workflows/ports.yml

@@ -26,16 +26,18 @@ jobs:
     runs-on: ubuntu-22.04
     timeout-minutes: 45
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: '22'
           cache: npm
           cache-dependency-path: ports/tauri/app/package-lock.json
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: '3.13'
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable 2026-08-05
       - name: Install pinned Rust dependency notice generator
         run: cargo install --locked --version 0.9.1 --features cli cargo-about
       - name: Assemble and verify the WSL2 resource bundle
@@ -46,7 +48,7 @@ jobs:
           ./packaging/windows/assemble-staging.sh
           ./packaging/windows/verify-bundle.sh ./packaging/.staging/windows
           tar -C packaging/.staging -czf "$RUNNER_TEMP/windows-staging.tar.gz" windows
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: port-windows-staging
           path: ${{ runner.temp }}/windows-staging.tar.gz
@@ -59,8 +61,10 @@ jobs:
     runs-on: windows-latest
     timeout-minutes: 90
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/download-artifact@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: port-windows-staging
           path: ${{ runner.temp }}/windows-staging
@@ -70,15 +74,15 @@ jobs:
           New-Item -ItemType Directory -Force -Path ports/tauri/packaging/.staging | Out-Null
           tar -xzf "$env:RUNNER_TEMP/windows-staging/windows-staging.tar.gz" -C ports/tauri/packaging/.staging
           if ($LASTEXITCODE -ne 0) { throw "Could not restore Windows staging" }
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: '22'
           cache: npm
           cache-dependency-path: ports/tauri/app/package-lock.json
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: '3.13'
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable 2026-08-05
       - name: Install NSIS
         run: choco install nsis --yes --no-progress
       - name: Build, install, smoke-test, and re-extract both Windows packages
@@ -93,7 +97,9 @@ jobs:
     runs-on: ubuntu-22.04
     timeout-minutes: 90
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
       - name: Install Linux build and runtime prerequisites
         run: |
           sudo apt-get update
@@ -102,15 +108,15 @@ jobs:
             libgstreamer1.0-dev libgstreamer-plugins-base1.0-dev libunwind-dev librsvg2-dev \
             libsane-dev libssl-dev libusb-1.0-0 libwebkit2gtk-4.1-dev squashfs-tools \
             libxdo-dev patchelf pkg-config sane-utils wget
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: '22'
           cache: npm
           cache-dependency-path: ports/tauri/app/package-lock.json
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: '3.13'
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable 2026-08-05
       - name: Install pinned Rust dependency notice generator
         run: cargo install --locked --version 0.9.1 --features cli cargo-about
       - name: Build, extract, smoke-test, and re-extract both Linux packages