Integration tests against an IRIS container for release-preparation PRs

[isc-klu]

Closes #1863. Integration suite against a real iris-community:latest-cd container, run by a new prepare-release.yml workflow on prepare-* PRs and on manual dispatch. The npm test step leaves the per-PR workflows.

Configurations × checks

Each workspace folder in test-fixtures/ci.code-workspace is one configuration, with its settings in the matching directory under test-fixtures/. src/test/suite/extension.test.ts runs the same check against every configuration it applies to.

Configuration	connects	lists namespace	save + delete syncs	toggle active	expired session	check after expiry
client-hostport: client-side, objectscript.conn with host/port and credentials, no intersystems.servers	✓	—	✓	✓	✓	✓
client-compose: client-side, objectscript.conn with docker-compose and credentials, no intersystems.servers	✓	—	✓	skipped	✓	skipped
client-named-server: client-side, objectscript.conn.server naming an intersystems.servers entry with credentials	✓	—	✓	✓	✓	✓
client-inactive: client-side, objectscript.conn active: false naming an intersystems.servers entry without a password (unreachable host)	stays inactive, exposes no password	—	—	—	—	—
server-side: server-side, isfs folder on an intersystems.servers entry with credentials (isfs folders have no objectscript.conn)	✓	✓	✓	—	✓	—

• connects: the credentials in settings are used without prompting, and serverForUri returns them. Issues: language-server#415 → serverForUri should preserve passwords stored in settings.json["objectscript.conn"] #1846 (client-hostport); Password requests #1858 → Fix docker-compose connections always prompting for password #1860 (client-compose); Extension fails to activate, isfs files can no longer be opened #1837 → Fix crash from unresolved auth on named-server connections #1836, Fix incompatibilities with pre-OAuth2 version of Server Manager #1820 (client-named-server, server-side); Cursor Remote SSH: vscode-objectscript activate() routinely hangs ~4.5 minutes after successful /api/atelier #1832 → Skip credential resolution for inactive connections during activation #1835, Fix hanging in activation when a server-side folder connection is inactive #1740 and serverForUri API discloses connection password to consumer extensions without user consent #1825 → Fix password disclosure via serverForUri and stale cookie reuse after logout/401 #1824 (client-inactive).
• lists namespace: readDirectory on the isfs root returns the namespace's documents. Client-side folders list local files, so it doesn't apply.
• save + delete syncs: a class written through the folder appears on the server and disappears when deleted, verified over REST.
• toggle active: objectscript.conn.active false, then true, is honoured. "Toggle Connection" does not work correctly since extension version 3.6.1-beta 9 ? #1747 → Fix issue that causes client-side connections to be forced active #1748; Multi-root workspace: activating each namespace reconnects all active connections and orphans CSP sessions, exhausting the license #1805 → Improve management of web sessions when connection changes #1808.
• expired session: after 13 s idle (server timeout 10 s), save + delete still works without prompting. User is intermittently unable to connect to server #1829, "Unauthorized"-Error after a time of inactivity #1823 → Retry once and delete cookies on failed #1830, Fix password disclosure via serverForUri and stale cookie reuse after logout/401 #1824.
• check after expiry: re-enabling after 13 s idle, the connection check recovers without prompting. Connection check runs on every editor change and turns an expired session into a password prompt; dismissing it disables a working connection #1861 → Fix connection check prompting/disabling on a merely-stale session #1864.

Verified to catch regressions by reverting the fix on master and watching the suite fail: #1846, #1860, #1830, #1864. Reverting #1835 did not fail the suite; activation didn't block here.

Skipped: the two client-compose cells that need the folder to go inactive. It never does: AtelierAPI.setConnection hard-codes active: true for a resolved docker-compose connection. Pre-existing; issue to follow.

Not covered: unauthenticated connections (#1840; IRIS routes any .../api/atelier path to the primary web app), UI-only paths (#1787, #1784), activation timeout (#1810), session leaks (#1805).

How it works

Every configuration connects to the same container, whose /api/atelier session timeout is 10 s so expiry checks meet a real 401. The suite takes ~90 s once the container is up; test-fixtures/README.md covers running it locally with Podman or Docker.

Activation dedupes connection checks by server name, so client-named-server (server ci, shared with server-side) only connects once a document in it becomes active. The test opens a file there to mirror that.

Runner fixes

npm test could not launch VS Code: @vscode/test-electron 2.x looks for the since-renamed Contents/MacOS/Electron (bumped to 3.x); Electron rejects -n; ELECTRON_RUN_AS_NODE from an extension-spawned terminal made VS Code run as plain Node; the mocha promise settled before the tests ran.