perf(e2e): share the Windows dev snapshot across the fork legs

.github/workflows/e2e.yml

@@ -7,25 +7,61 @@
 # (Linux only).  The OS elevation prompt cannot be automated, but the copy
 # core — including the defaults/pref directory walk-up — is tested here.
 #
-# Updater E2E: builds a dev snapshot, installs Firefox, creates a test profile
-# with scripts, launches Firefox via puppeteer-core + WebDriver BiDi, and
-# asserts the updater tab renders the correct state. Advisory gate across
-# the supported browser × OS matrix.
+# Updater E2E: uses the shared dev snapshot (built once by the `snapshot`
+# job), installs Firefox, creates a test profile with scripts, launches
+# Firefox via puppeteer-core + WebDriver BiDi, and asserts the updater tab
+# renders the correct state. Advisory gate across the supported browser × OS
+# matrix.
 #
 # See: docs/e2e-matrix-plan.md, https://github.com/onemen/firefox-scripts/issues/3
 
 name: E2E
 
+permissions:
+  contents: read
+
 on:
   pull_request:
   push:
     branches: [main]
+  workflow_dispatch:
 
 concurrency:
   group: e2e-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
+  # ── Windows dev snapshot (shared by the fork legs) ───────────────────────
+  # The browser-matrix legs (librewolf, floorp) run on windows-latest with an
+  # identical workspace path, so one Windows snapshot is hash-consistent for
+  # all three: LOCAL-mode URLs baked into utils.zip point at the same dist dir
+  # on every job. Sharing across OSes is impossible — the baked path is part
+  # of the hashed utils file set, so a repointed config flips the package hash
+  # and the updater sees a false "update available".
+  snapshot-win:
+    name: build windows dev snapshot
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
+        with:
+          version: 11
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+
+      - name: Build snapshot
+        run: pnpm upload:local --mode=dev
+
+      - name: Upload dev snapshot
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: dev-snapshot-win
+          path: dist/
+          if-no-files-found: error
+
   # ── Installer E2E ──────────────────────────────────────────────────────────
   installer:
     name: 'installer E2E · ${{ matrix.os }}'
@@ -180,6 +216,7 @@ jobs:
   # Firefox Dev Edition, Waterfox, and Zen require manual install.
   browser-matrix:
     name: 'updater E2E · ${{ matrix.browser }} · windows-latest'
+    needs: snapshot-win
     runs-on: windows-latest
     strategy:
       fail-fast: false
@@ -205,8 +242,15 @@ jobs:
       - name: Install ${{ matrix.browser }}
         run: node tools/test/e2e/downloads.mjs ${{ matrix.browser }}
 
-      - name: Build snapshot
-        run: pnpm upload:local --mode=dev
+      # Restores dist/dev-<branch>-<sha>/ built by snapshot-win. `needs`
+      # already waits for that job, so the artifact always exists here. The
+      # Windows snapshot's baked LOCAL_DIST_PATH matches this runner's path,
+      # so the hash check stays consistent.
+      - name: Download dev snapshot
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+        with:
+          name: dev-snapshot-win
+          path: dist/
 
       - name: Run updater E2E
         run: node tools/test/e2e/updater-e2e.mjs