fix: restore main CI — platform-aware installer test + the F28 doctrine obeys its own rule (#1109 follow-up)

packages/extension/skills/amico-vault/SKILL.md

@@ -105,7 +105,7 @@ How vault paths are written down — in notes, specs, skills, and examples — i
 - The **personal** mount by **role** — "the personal vault", resolved from the mount stack — never by its directory or marker name.
 - The **team** mount by **kind** — "the team mount". A concrete instance (`armonissima`) may appear in an example, labeled as an instance — never as the identifier.
 - The ops tree only ever as `$AMICO_OPS/…`.
-- **Never a raw home path embedding a vault or repo name** in prose or examples — those are the ones that rot on renames. Proof case: the 2026-08-21 personal-vault rename (`vault-aaron` → `armonia-aaron-trowbridge`), whose aftermath — clients silently riding the rename redirect — is exactly the silent rot this rule exists to prevent.
+- **Never a raw home path embedding a vault or repo name** in prose or examples — those are the ones that rot on renames. Proof case: the 2026-08-21 personal-vault rename (the personal vault's directory name changed under it), whose aftermath — clients silently riding the rename redirect — is exactly the silent rot this rule exists to prevent. This doctrine obeys its own rule: the rotted names are deliberately NOT reproduced here — the mechanical `[vpath]` rule cannot tell a proof case from a violation, and that is the point.
 
 The skills lint's `[vpath]` rule (`lint-skills.mjs`, #1100) flags the known-rotted shapes mechanically; this section is the doctrine it serves.
 

packages/extension/test/fleet_scripts_projection.test.ts

@@ -251,10 +251,19 @@ describe("the installer consumes the verb (never greps the raw file)", () => {
   it("verb exit 0 + role client → the fleet branch with the parsed port (proceeds past the topology gate)", () => {
     fakeAmico({ code: 0, stdout: verbJson("client", { host: "hq", port: 4096, sshAlias: "hq" }) });
     const r = runScript(INSTALL, ["--check"], installEnv());
+    // The BRANCH proof: the parsed role + port flowed through — never the standalone skip.
     expect(r.out).toMatch(/fleet role: client \(port: 4096\)/);
-    // --check then fails on the missing installed guard — the TOPOLOGY branch was taken
-    expect(r.code).toBe(1);
-    expect(r.out).toMatch(/guard not installed/);
+    expect(r.out).not.toMatch(/fleet checks skipped|nothing to install/);
+    // The terminal outcome is platform-specific BY DESIGN: on darwin, --check
+    // fails on the missing installed guard; on non-darwin the installer skips
+    // the host check ("the fleet is a darwin fleet") and completes green.
+    if (process.platform === "darwin") {
+      expect(r.code).toBe(1);
+      expect(r.out).toMatch(/guard not installed/);
+    } else {
+      expect(r.code).toBe(0);
+      expect(r.out).toMatch(/host check skipped/);
+    }
   });
 
   it("verb exit 75 → the bootstrap exception: base-standalone STATED with the pointer, exit 0 (identical to CLI-absent)", () => {