Test the telemetry consent path in release builds, and enable the telemetry smoke tests on arm64

.github/workflows/Build.Windows.Job.yml

@@ -77,21 +77,29 @@ jobs:
              --features "${{ matrix.features }}"
 
       - name: Build debug executor for isolated telemetry smoke tests
-        if: matrix.arch == 'x64'
         run: cargo build --locked -p wxc --features test-support
 
       - name: Run isolated telemetry consent smoke test
-        if: matrix.arch == 'x64'
         working-directory: ${{ github.workspace }}
         shell: pwsh
         run: tests\scripts\run_telemetry_consent_smoke_test.ps1 -BinDir src\target\debug
 
       - name: Run isolated telemetry ETW smoke test
-        if: matrix.arch == 'x64'
         working-directory: ${{ github.workspace }}
         shell: pwsh
         run: tests\scripts\run_telemetry_etw_smoke_test.ps1 -BinDir src\target\debug
 
+      # Mutates the real consent store and HKLM policy, so it is confined to
+      # the ephemeral GitHub-hosted runners this job declares.
+      - name: Run release-path telemetry consent test
+        working-directory: ${{ github.workspace }}
+        shell: pwsh
+        run: |
+          tests\scripts\run_telemetry_consent_release_test.ps1 `
+            -BinDir src\target\${{ matrix.target }}\release `
+            -AcceptRealMachineMutation `
+            -RequirePolicyCeiling
+
       - name: Upload binaries
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:

tests/scripts/README.md

@@ -47,7 +47,8 @@ Linux / macOS (`.sh`):
 | `run_processcontainer_all_tests.ps1` | Process container (AppContainer / BaseContainer) primitives suite — tier probes, rw/ro/denied matrix, enumeration-only grants, UI mitigations, DACL restore, crash recovery, schema 0.8 networking. Dispatches to the per-area `run_processcontainer_*_test.ps1` scripts | `wxc-exec.exe`, `wxc-ui-probe.exe`, `plm.exe` and `winhttp-proxy-shim.exe` beside `wxc-exec.exe` |
 | `T3-Workloads.ps1` | Real workloads (pwsh, git, node, python, cmd) on top of the T3 primitives. A missing interpreter is reported as a skip, not a failure | `wxc-exec.exe`; `pwsh` / `git` / `node` / `python` each optional, gating their own cases |
 | `run_telemetry_consent_smoke_test.ps1` | Consent maintenance, presentation, policy, and exit-code smoke tests | Debug `wxc-exec.exe` built with `test-support` |
-| `run_telemetry_etw_smoke_test.ps1` | Isolated consent flow plus public-provider ETW capture | Debug `wxc-exec.exe` built with `test-support`; ETW tooling |
+| `run_telemetry_etw_smoke_test.ps1` | Isolated consent flow plus public-provider ETW capture | Debug `wxc-exec.exe` built with `test-support`; ETW tooling; Administrator, otherwise the test skips |
+| `run_telemetry_consent_release_test.ps1` | Consent path in a **release** executor, where the debug store/policy overrides are compiled out. Mutates the real consent store and HKLM policy, so it requires `-AcceptRealMachineMutation` and an ephemeral machine | Release `wxc-exec.exe`; Administrator for the HKLM policy section, otherwise that section skips unless `-RequirePolicyCeiling` is passed |
 | `run_on_repeat.ps1` | Stress test (loops core tests) | `wxc-exec.exe` |
 
 Each `run_processcontainer_<area>_test.ps1` also runs standalone against a