feat: deploy.sh verify + frozen-path mock tests (#175)

[cheerc]

What

Add deploy.sh verify subcommand for pre-PR build verification + expand frozen-path test coverage with version fallback and import smoke tests.

How

• deploy.sh verify: build .app → launch → wait 8s → grep log for ERROR/exception/Traceback → kill app → report PASS/FAIL
• test_frozen_paths.py: added TestGetAppVersion (3-tier fallback: metadata → pyproject.toml → '0.0.0') + TestImportSmoke (7 core module imports)

Scope

follows plan — Task 1 (deploy.sh) + Task 2 (test_frozen_paths.py) + Task 5 (integration test)

Lessons

• Frozen-path mock tests (sys.frozen=True) exercise code paths never hit in dev mode — catches regression like [bug] check_update() broken in frozen (PyInstaller) build — importlib.metadata.version fails #174
• Import smoke tests catch missing --hidden-import at unit-test level, no .app build needed

Closes #175

Build Verification

• ./deploy.sh verify PASS — log clean, no errors detected
• uv run pytest tests/test_frozen_paths.py -v — 17/17 PASS
• uv run ruff check tests/test_frozen_paths.py — clean

🤖 Generated with Claude Code

[cheerc]

Review Verdict: VERIFIED ✅

Scope

• deploy.sh — adds do_verify subcommand (build .app → launch → check log → report)
• tests/test_frozen_paths.py — adds TestGetAppVersion (3-tier fallback) + TestImportSmoke (7 core module imports)

Reviewed

• reviewed_head: cf8dfb9
• CI: Lint & Test ✅ pass
• Conflict markers: none found
• Runtime evidence: provided in PR body (verify PASS, 17/17 pytest, ruff clean)

Stage 1 — Correctness

• do_verify correctly integrates with existing helpers (detect_platform, do_build, pass)
• Log counting (prev_count → new_count) correctly identifies fresh log file
• grep -iE + || true handles zero-matches gracefully
• TestGetAppVersion covers all 3 fallback tiers with proper isolation via monkeypatch
• TestImportSmoke provides 7 independent import tests (each a separate test method)

Stage 2 — Adversarial

• No security/API/contract changes beyond scope
• No blast-radius concerns (test-only + dev-tool shell script)
• Mock patches are scoped to monkeypatch — no cross-test leakage

Minor Observation

do_verify exits 0 on non-macOS ("⚠ verify currently only supports macOS"), which could misleadingly suggest verification passed. Consider exit 1 for CI-awareness, or a more explicit warning. Not a blocker.

Evidence

• ran: gh pr checks 186 --json name,bucket → Lint & Test: pass
• ran: conflict markers scan → clean
• cited: deploy.sh:68 — pkill -f "${APP_NAME}" 2>/dev/null || true (proper error handling)
• cited: tests/test_frozen_paths.py:108-152 — 3-tier fallback mock tests covering all code paths
• cited: tests/test_frozen_paths.py:157-194 — 7 import smoke tests, each independent test method

[cheerc]

VERIFIED

Scope

• Depth: D1 (Fast path)
• Files: deploy.sh, tests/test_frozen_paths.py

Findings

• [Stage 1 - correctness] The deploy.sh verify subcommand implements robust logic for log tailing and grep verification.
• [Stage 1 - correctness] Test suite successfully covers importlib.metadata fallbacks via solid monkeypatch patterns and adds necessary module import smoke tests.
• [Stage 1 - correctness] "Build Verification" section in PR body confirms PASS status.

Evidence

• ran: gh pr checks 186 → Lint & Test pass
• cited: PR body build verification