ci: scope the cross-platform tunnel job to the seam tests (refs #897)

The new windows/macOS job ran the full docker + tunnelhub packages, which
fails on Windows for reasons that predate this branch: three tests assert
POSIX file modes (0600) that Windows does not implement (os.Chmod only
toggles the read-only bit, so Stat reports 666), one asserts a
world-readable file is refused, and one assumes Unix path separators.
macOS passes all of them. Filed as #897.

Scope the job with -run to the seam's own !linux tests. The full test
binaries are still compiled for each platform, so a Windows/macOS build
break is still caught; only the stub behaviour is executed. Assert that at
least 4 seam tests actually ran, since -run passes vacuously when its
pattern matches nothing.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: ako

.github/workflows/push-test.yml

@@ -25,7 +25,31 @@ jobs:
         with:
           go-version: '1.26.6'
       - name: Test the tunnel seam
-        run: go test ./cmd/mxcli/docker/... ./cmd/mxcli/tunnelhub/...
+        shell: bash
+        # Scoped with -run to the seam's own tests. The full test binaries are still
+        # COMPILED for this platform, so a Windows/macOS build break is still caught;
+        # only the !linux stub behaviour is executed.
+        #
+        # Running the whole packages here fails on Windows for reasons that predate
+        # this change and are unrelated to the tunnel: several tests assert POSIX file
+        # modes (0600) that Windows does not implement — os.Chmod only toggles the
+        # read-only bit, so Stat reports 666 — plus one path-separator assumption.
+        # Tracked separately in #897; widening this job is that issue's job, not this
+        # one's.
+        #
+        # -run can pass vacuously if the tests are renamed or deleted, so assert that
+        # the expected number actually ran.
+        run: |
+          out=$(go test -v -count=1 -run 'Unsupported' ./cmd/mxcli/docker/... ./cmd/mxcli/tunnelhub/...)
+          echo "$out"
+          n=$(printf '%s\n' "$out" | grep -c '^--- PASS: Test.*Unsupported' || true)
+          echo "seam tests executed: $n"
+          if [ "$n" -lt 4 ]; then
+            echo "FAIL: expected at least 4 tunnel-seam tests to run, -run matched $n."
+            echo "      The !linux stubs in cmd/mxcli/docker and cmd/mxcli/tunnelhub"
+            echo "      must each keep a test whose name contains 'Unsupported'."
+            exit 1
+          fi
 
   build-and-test:
     runs-on: ubuntu-latest