fix(wake): #912 exercise the digest/HMAC trust suite in real CI (fix runner divergence + openssl + hard-require) (#921)

Co-authored-by: jason.woltje <jason@diversecanvas.com>
Co-committed-by: jason.woltje <jason@diversecanvas.com>

packages/mosaic/framework/tools/wake/test-wake-install.sh

@@ -219,8 +219,15 @@ echo "== I7: ingested_ts staleness — a far-future emit_ts still goes stale (re
 ) && ok
 
 echo "== I8: beacon HMAC-verify at record — a spoofed (bad-sig) beacon is REJECTED =="
+# #912: hard-require openssl in CI (Woodpecker sets CI=woodpecker) so the install
+# beacon-sign leg is actually exercised; keep the skip for openssl-less local dev.
 if ! command -v openssl >/dev/null 2>&1; then
-  echo "SKIP: openssl not available" >&2
+  if [ -n "${CI:-}" ]; then
+    echo "  FAIL: I8 requires openssl in CI (#912) but it is not on PATH — the CI image must provide it" >&2
+    echo "x" >>"$FAILFILE"
+  else
+    echo "SKIP: openssl not available (local dev; CI hard-requires it)" >&2
+  fi
 else
 (
   H="$(fresh i8)"