fix(ci): match the @wdio/utils tarball by pattern, drop the dead override

[goosewobbler]

Three places named the @wdio/utils tarball and none of them agreed:

Location	Value	From
electron-builder-app-{cjs,esm} sandbox config	wdio-utils-9.23.0.tgz	#94
scripts/test-package.ts	wdio-utils-9.23.3.tgz	#132
scripts/update-packages.ts — the only producer	${packedFile}, from npm pack	—

The producer names the file after whatever version it packed; both consumers pinned a version, and pinned different ones. #132 bumped one and left the other. No such tarball exists in the tree, and it isn't gitignored, so it isn't an expected build artifact either.

The fixture pin was unreachable

test-package.ts discards every file: override from the fixture config before assembling the sandbox:

for (const [key, value] of Object.entries(sourceOverrides)) {
  if (!value.startsWith('file:')) {      // file: overrides dropped
    preservedOverrides[key] = value;
  }
}

So that line was read and thrown away on every run since #94. Removed.

The minimatch: 10.2.2 override sitting next to it is a plain version, not a file: spec, so it is preserved and applied — it stays.

The pinned lookup failed silently

That one is reachable, but guarded by existsSync. Pack a patched @wdio/utils via update-packages.ts at any version other than exactly 9.23.3 and the guard misses, the override is skipped without a word, and the package tests go green having never exercised the build you just made. A silent no-op, which is the worse failure mode — you'd trust the result.

Now matched by pattern, so a regenerated tarball is picked up at any version. More than one candidate throws rather than picking arbitrarily.

Verification

Exercised all three paths:

• No tarball (the normal case): no override applied, electron-builder-app-cjs package test passes end to end.
• An arbitrary version present (wdio-utils-99.0.0.tgz): matched by the new pattern — and confirmed the old 9.23.3 pin would not have matched it. This is precisely the bug.
• Two tarballs present: throws, naming both.

format:check and lint clean.

Also updates the cache-safety comment in setup-workspace/action.yml, whose reasoning was written around the fixture override that this PR deletes. The conclusion is unchanged — the root lockfile still never references the tarball — but it now points at test-package.ts, which is where the override actually comes from.

[github-actions]

Release Preview — no release

No bump label detected.
Note: Add bump:patch, bump:minor, or bump:major to trigger a release.

---

Updated automatically by ReleaseKit