Skip nested public-surface scans inside package_distribution tests

[VladimirBrejcha]

Why this is real

GitHub-hosted Ubuntu Node CI still times out. After snapshot tests were given the fixture simctl adapter, test:client spent most of a 30-minute job inside four package_distribution.sh cases. Each case reruns a full-repo npm run verify:public-surface (the packager calls that gate before signing).

The operator accepted the red Ubuntu badge for Alpha. The published CLI tarball is not produced by that Ubuntu job. The nested scans are still real work: they make the advertised public Node suites unusable on GitHub-hosted Ubuntu.

This project is Alpha, macOS-only, and needs Xcode. This ticket is only the nested scan.

Expected

scripts/package_distribution.sh should not force a full-repo public-surface scan when invoked from those client tests. A skip flag, or a cheaper dirty-tree-only scan already used by the default scanner, is enough. npm run verify:public-surface remains the standalone gate.

Likely files

• scripts/package_distribution.sh
• client/test/install-distribution.test.mjs

Out of scope

• Homebrew, notarized app, npm
• Raising the Ubuntu timeout without removing the nested scans
• Changing the self-hosted OpenCodeReview workflow