fix(pr-verify): install the screenshot font and match the key proxy by command line

.github/scripts/pr-verify/workflow.test.mjs

@@ -1324,6 +1324,7 @@ const SIBLING_INIT = readFileSync(new URL("./sibling-init.sh", import.meta.url),
 const SANDBOX_STEPS = [
   "Create the key proxy's user and directories",
   "Install the driven Claude Code",
+  "Install the screenshot font",
   "Install the driver and its engine",
   "Write the driven settings and the proxy config",
   PROXY_START,
@@ -2272,6 +2273,32 @@ test("every new capture step is bounded and runs only with the key set", () => {
   }
 });
 
+test("the screenshot font is installed before isolation and checked for U+23F8", () => {
+  // Runner probe run 42224592725: without it the rasterizer refuses U+23F8 and no screenshot is written.
+  assert.ok(capIndex("Install the screenshot font") < capIndex(ISOLATE));
+  const script = scriptOf(capStep("Install the screenshot font"));
+  assert.match(script, /apt-get install -y --no-install-recommends fonts-noto-core/);
+  assert.match(script, /fc-list ':charset=23f8'/);
+  assert.match(script, /exit 1/);
+});
+
+test("stopping the key proxy matches the proxy's node command line, not its sh watcher", () => {
+  // Node's comm is MainThread (runner probe run 42223922880), so `pgrep -x node` never matched.
+  const stop = scriptOf(capStep("Stop the key proxy"));
+  assert.doesNotMatch(stop, /pgrep[^\n]*-x node/);
+  const pattern = /^proxy='(.*)'$/m.exec(stop)?.[1];
+  assert.ok(pattern, "the stop step names its pgrep pattern");
+  assert.equal((stop.match(/pgrep -u ccd-proxy -f "\$proxy"/g) ?? []).length, 2);
+  const start = scriptOf(capStep(PROXY_START));
+  const node = / exec \/usr\/bin\/env -i PATH=\/usr\/bin:\/bin (\/opt\/ccd\/bin\/node [^']*?) 2>>/.exec(start)?.[1];
+  assert.ok(node, "the start step execs node with a known command line");
+  const watcher = /\/bin\/sh -c '([^']*)'/.exec(start)?.[1];
+  assert.ok(watcher);
+  const re = new RegExp(pattern);
+  assert.match(node, re);
+  assert.doesNotMatch(`/bin/sh -c ${watcher}`, re);
+});
+
 test("a capture job that hands off leaves capture-subscription time inside the judges' wait", () => {
   // The subscription job's own bound, after a handoff measured at 36 s from
   // job start (run 41984197946), stays inside find-capture.mjs WAIT_MS.

.github/workflows/pr-verify-capture.yml

@@ -420,6 +420,18 @@ jobs:
           "$dir/node_modules/.bin/claude" --version | grep -qF "$version"
           sudo chown -R root:root "$dir"
 
+      # The driver's screenshot rasterizer needs Noto Sans Symbols 2 for
+      # glyphs such as U+23F8, and refuses the capture without them; the
+      # sandbox has no network, so the font goes in now.
+      - name: Install the screenshot font
+        if: steps.credential.outputs.present == 'true'
+        timeout-minutes: 5
+        run: |
+          sudo apt-get update -qq
+          sudo apt-get install -y --no-install-recommends fonts-noto-core >/dev/null
+          fonts=$(fc-list ':charset=23f8' family)
+          [[ $fonts == *"Noto Sans Symbols 2"* ]] || { echo "::error::no installed font has U+23F8"; exit 1; }
+
       # A root-owned copy of main's driver and launch broker (the broker
       # refuses a driver, config or deps directory it can write), with the
       # engine installed and its signatures checked now: the sandbox has no
@@ -1074,11 +1086,14 @@ jobs:
         timeout-minutes: 1
         run: |
           touch /run/ccd-stop/stop
+          # Node names its main thread MainThread, so the match is on the
+          # command line, anchored past the watcher's sh -c text.
+          proxy='^/opt/ccd/bin/node /opt/ccd/key-proxy/key-proxy\.mjs '
           for _ in $(seq 20); do
-            pgrep -u ccd-proxy -x node >/dev/null || break
+            pgrep -u ccd-proxy -f "$proxy" >/dev/null || break
             sleep 0.5
           done
-          if pgrep -u ccd-proxy -x node >/dev/null; then
+          if pgrep -u ccd-proxy -f "$proxy" >/dev/null; then
             echo "::warning::the key proxy is still running"
             exit 1
           fi