ci(release): skip macOS verification safely

[notgitika]

What

Release verification can remain blocked waiting for the macOS runner after Linux and Windows have passed, as in run 35777299022.

• Adds an optional skip_macos input to the reusable verification workflow, defaulting to false.
• Builds the matrix directly from the selected compilation targets instead of combining an include-only matrix with exclude.
• Sets skip_macos: true only in the release-publish workflow. Regular CI continues to verify Linux, Windows, and macOS.

Why

The earlier attempt in #2381 used a dynamic exclude with an include-only matrix. That caused verification jobs to stop materializing and was reverted in #2385.

This version does not use include or exclude to select platforms. The release caller produces a Linux/Windows target array, while callers using the default produce Linux/Windows/macOS.

Validation

• actionlint 1.7.12 on both changed workflows
• Prettier check on both changed workflows
• git diff --check

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[agentcore-devx-automation]

AgentCore Harness Review

Verdict: Looks good

CI-only change; logic verified end-to-end:

• matrix.target is derived directly from fromJSON(inputs.skip_macos && '[...]' || '[...]'), avoiding the include/exclude interaction that broke #2381.
• name and runs-on expressions correctly resolve for all three targets (linux-x64 → Linux/CodeBuild-linux, windows-x64 → Windows/CodeBuild-windows, darwin-arm64 → macOS/macos-latest via the || fallback).
• Smoke test path ./dist/bin/agentcore-${{ matrix.target }}${{ matrix.target == 'windows-x64' && '.exe' || '' }} reproduces the previous per-target binaries.
• skip_macos: true is only passed from release-main-and-preview.yml, so regular PR CI still verifies macOS. The macOS binary itself is still compiled on ubuntu-latest in the publish job and uploaded to the release, so skipping the macOS verify leg doesn't drop the darwin-arm64 artifact — only the on-macOS smoke test and unit tests, which is a reasonable tradeoff to unblock releases from flaky macOS runners.

One low-priority maintenance note (non-blocking): the name/runs-on fallback arms both default to macOS, so any future fourth target would silently be labeled/routed as macOS until those expressions are updated. Fine to leave as-is given the target list is right there in the matrix.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.25%. Comparing base (484fdde) to head (46a1d10).

Additional details and impacted files

@@            Coverage Diff            @@
##           refactor    #2388   +/-   ##
=========================================
  Coverage     97.25%   97.25%           
=========================================
  Files           613      613           
  Lines         41028    41028           
=========================================
  Hits          39902    39902           
  Misses         1126     1126           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

Thanks for the report, @codecov-commenter — feedback like this is exactly
how we catch the things we missed. Because this PR is already
closed, the team won't see follow-up comments here.

Would you mind opening a new issue so we can track it properly?
https://github.com/aws/agentcore-cli/issues/new/choose

If this is a security issue, please report it privately via
https://aws.amazon.com/security/vulnerability-reporting/ instead
of a public issue.