fix(wake): #912 exercise the digest/HMAC trust suite in real CI (fix runner divergence + openssl + hard-require) (#921)

Co-authored-by: jason.woltje <jason@diversecanvas.com>
Co-committed-by: jason.woltje <jason@diversecanvas.com>

packages/mosaic/framework/tools/wake/test-wake-beacon.sh

@@ -296,8 +296,15 @@ echo "== B11: staleness from monitor ingested_ts -> a far-future emit_ts STILL g
 ) && ok
 
 echo "== B12: HMAC-verify at record -> a spoofed (bad-sig) beacon is REJECTED =="
+# #912: hard-require openssl in CI (Woodpecker sets CI=woodpecker) so the beacon
+# HMAC-verify leg is actually exercised; keep the skip for openssl-less local dev.
 if ! command -v openssl >/dev/null 2>&1; then
-  echo "SKIP: openssl not available" >&2
+  if [ -n "${CI:-}" ]; then
+    echo "  FAIL: B12 requires openssl in CI (#912) but it is not on PATH — the CI image must provide it" >&2
+    echo "x" >>"$FAILFILE"
+  else
+    echo "SKIP: openssl not available (local dev; CI hard-requires it)" >&2
+  fi
 else
 (
   H="$(fresh_home b12)"