fix(ci): repair the failing master checks (#13051)

* test(ui): fix stale and timing-bound Home and NotFound specs

The Home slash menu spec dropped /skill from its expected list, but the
test server always keeps built-in skills, so /skill is offered. Restore
the expected list.

The NotFound spec loaded fourteen removed addresses in one test. A CI
trace showed about four seconds per address, so the test passed the 30
second limit before the loop ended. Run one test per address.

The Home skeleton spec delayed the answer by a fixed 800 ms, which a
slow runner can spend before it paints. Hold the answer until the
skeleton was seen.

Assisted-by: Claude Code:claude-sonnet-5-5
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>

* test(addons): register new Ginkgo cases in the suite inventory

The harness compares the cases a suite reports with the cases listed in
scripts/addons/suites.json. The Sandbox document skills change added
five packaging cases that no entry listed, and the apps entry listed 265
cases while its four reports list 274. Both suites failed with an
inventory mismatch although every spec passed.

List the five packaging cases in the contracts entry and its packaging
report, and the nine missing apps cases in the apps entry.

Assisted-by: Claude Code:claude-sonnet-5-5
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>

* test(ui): let the route change finish before counting add-on reads

The apps polling spec leaves the add-ons page for a lazily loaded route
while the page clock is paused. The transition does not finish until the
clock moves, so the first step of the 180 second run still saw the
add-ons page mounted and fired one more read. The spec failed in four of
six local runs. Its sibling spec already advances the clock and settles
before it counts.

Do the same here, and wait for the NotFound page so the check is made on
a page that no longer holds the add-ons list.

Assisted-by: Claude Code:claude-sonnet-5-5
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>

* test(studio): stop the scoped-chat spec timing out on the nib harness

The spec "opens a scoped chat with load_skill without reentering session
access resolution" opened its chat on the real nib harness. Starting a
nib session takes about a second under -race and more on a loaded CI
runner, so Open sometimes passed the two second budget and the spec
reported a re-entrant resolution that did not exist. The distributed
test job failed on it while the plain tests job passed.

Run the spec on the stub harness, so Open only builds the chat tools,
which is what the spec is about. Widen the hang guard to 30 seconds: a
real re-entry blocks on the open lock for good, so any finite bound
tells it from a slow run.

Assisted-by: Claude Code:claude-sonnet-5-5
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>

---------

Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
Co-authored-by: Ettore Di Giacinto <mudler@localai.io>

scripts/addons/suites.json

@@ -554,7 +554,12 @@
       "accepts empty arguments with optional property constraints",
       "refuses protected or reserved plain names, whatever the add-on id",
       "keeps embedded names protected or reserved without requiring a slot fallback",
-      "does not promise a core fallback for document provider names"
+      "does not promise a core fallback for document provider names",
+      "packages all four document slots with the actual validator and no core fallback",
+      "proves every source block and local reference without Git or network",
+      "installs unchanged PDF helpers and their license with a build-time fixture check",
+      "declares and packages a loadable, receipt-verified skill without shadows",
+      "rejects a missing skill, mismatched frontmatter, and scripts"
     ],
     "report": ".cache/addons/logs/contracts.json",
     "reports": [
@@ -985,7 +990,12 @@
           "lets a tag push prepare the immutable version and never move latest",
           "promotes latest only for a published, stable, non-draft release",
           "rejects unknown events and a malformed commit",
-          "prints the decision as key=value lines"
+          "prints the decision as key=value lines",
+          "packages all four document slots with the actual validator and no core fallback",
+          "proves every source block and local reference without Git or network",
+          "installs unchanged PDF helpers and their license with a build-time fixture check",
+          "declares and packages a loadable, receipt-verified skill without shadows",
+          "rejects a missing skill, mismatched frontmatter, and scripts"
         ]
       },
       {
@@ -4012,7 +4022,16 @@
       "returns the SDK refusal text, the unverified-package text and the missing-release text to the administrator",
       "logs the cause of a failed install and types it for the client",
       "logs the reason behind a generic denial and leaves the response unchanged",
-      "names every typed cause of a failed install in the 403 of the dispatch route"
+      "names every typed cause of a failed install in the 403 of the dispatch route",
+      "installs upgrades and uninstalls the actual Sandbox document skills through verified receipts",
+      "finishes a real backup and commit after the submitting request is cancelled",
+      "polls and retries during a blocked backup, rejects conflicting IDs, and retains the receipt on restart",
+      "reconciles durable accepted work to interrupted without replay",
+      "Close cancels and joins an accepted owner worker before releasing storage",
+      "traces completion, retries, detach, interruption and late delivery without replay",
+      "keeps terminals immutable for every event and gives each active state a terminal exit",
+      "Close cancels a backup in flight and joins its cleanup before releasing ownership",
+      "serializes synchronous disable against an accepted upgrade without overwriting its journal"
     ],
     "report": ".cache/addons/logs/apps.json",
     "reports": [