FEATURE-ci-v3-integration: execute VM archive staging as separate commands

Exercise the actual FreeBSD staging step with a selected descriptor, preserving newlines so the VM receives the archive inputs. Behavioral RED/GREEN and actionlint pass; focused contract total is 100.

Author: etr

.github/workflows/v3-release-acceptance.yml

@@ -220,7 +220,9 @@ jobs:
         persist-credentials: false
     - name: Download immutable selected archive
       run: python3 scripts/run-v3-release-ci.py download --artifact-id "$SELECTED_ID" --digest "$SELECTED_DIGEST" --output "$RUNNER_TEMP/selected"
-    - run: mkdir -p build cp -R "$RUNNER_TEMP/selected" build/ci-selected-input
+    - run: |
+        mkdir -p build
+        cp -R "$RUNNER_TEMP/selected" build/ci-selected-input
     - uses: vmactions/freebsd-vm@c9f815bc7aa0d34c9fdd0619b034a32d6ca7b57e
       with:
         release: '14.3'

scripts/test-v3-ci-workflows.py

@@ -17,6 +17,19 @@ def workflow(name):
 
 
 class CIWorkflows(unittest.TestCase):
+    def test_freebsd_stages_selected_archive_for_vm_transfer(self):
+        steps = workflow('v3-release-acceptance.yml')['jobs']['freebsd']['steps']
+        run = next(step['run'] for step in steps if 'ci-selected-input' in step.get('run', ''))
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            selected = root / 'runner' / 'selected'
+            selected.mkdir(parents=True)
+            (selected / 'selected.json').write_text('selected archive identity')
+            result = subprocess.run(['bash', '-e', '-c', run], cwd=root,
+                env=dict(os.environ, RUNNER_TEMP=str(root / 'runner')), capture_output=True, text=True)
+            self.assertEqual(result.returncode, 0, result.stderr)
+            self.assertEqual((root / 'build/ci-selected-input/selected.json').read_text(), 'selected archive identity')
+
     def test_release_request_resolver_emits_structured_commit_and_version(self):
         steps = workflow('v3-release-acceptance.yml')['jobs']['prepare']['steps']
         run = next(step['run'] for step in steps if step.get('id') == 'request')

specs/tasks/FEATURE-ci-v3-integration.md

@@ -29,7 +29,7 @@ are unchanged and cannot replace fresh evidence.
 
 Local verification: native TLS-off/on suites (239/270 tests, two documented
 nonlocal backend skips in each), all eleven sanitizer fuzz targets, genuine
-Doxygen/Graphviz, GCC QUIC replay and 99 focused CI/release/fuzz contracts passed.
+Doxygen/Graphviz, GCC QUIC replay and 100 focused CI/release/fuzz contracts passed.
 The fresh Linux installed attempt passed TLS-off but failed TLS-on public TLS at
 unprivileged TCP443 binding. Its unsuccessful receipt remains unchanged. A fresh
 focused public TLS run using the existing isolated network path passed all four