verify-action-build: fix RESULT panel cause on binary-download failure

[potiuk]

Summary

Observed on PR #724's verify run: the summary table correctly showed JS build verification: ✓ compiled JS matches rebuild and Binary download verification: ✗ 1 unverified download(s) — but the RESULT panel still said "Differences detected between published and rebuilt JS", which was not the cause of failure.

Root cause

In verify_single_action, the failure branch chose its message based on is_js_action first and hardcoded the JS-mismatch string for every JS action. Since #743, the binary-download check runs for every action type (including JS actions), so overall_passed = all_match and not binary_download_failures can go false via the second term alone — but the RESULT text would still blame JS.

Fix

Dispatch on the actual failure condition:

• all_match == False → JS-mismatch message (with or without the lock-file-retry variant).
• Otherwise, binary_download_failures → binary-download message.
• Fallback → generic "verification failed".

Test plan

• New TestVerifySingleActionResultMessage class in test_verification.py:
  • test_js_action_with_unverified_download_reports_binary_cause — the regression case; fails without the fix, passes with it
  • test_js_action_with_js_mismatch_reports_js_cause — guards the original JS-mismatch path stays intact
• Full tests/verify_action_build/ suite green: 137 passed (was 135 before the 2 new tests)
• Re-run verify on PR action-allowlist-review: bump posit-dev/setup-air from 1.0.0 to 1.0.1 in /.github/actions/for-dependabot-triggered-reviews #724 after merge to confirm the RESULT panel reads correctly

Related

• verify-action-build: add binary download verification check #743 — introduced the binary-download check
• PR action-allowlist-review: bump posit-dev/setup-air from 1.0.0 to 1.0.1 in /.github/actions/for-dependabot-triggered-reviews #724 — run that surfaced the incorrect message

[potiuk]

Verified end-to-end on posit-dev/setup-air@cf390573ff4fe0f198f35df3a642b1409328d859 (the ref bumped by PR #724) using this branch:

Verification Summary
┏━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
┃ Check                          ┃ Status ┃ Detail                        ┃
┡━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┩
│ Action type detection          │   ℹ    │ node24                        │
│ Binary download verification   │   ✗    │ 1 unverified download(s)      │
│ JS build verification          │   ✓    │ compiled JS matches rebuild   │
│ Approved versions              │   ℹ    │ 1 version(s) on file          │
│ Source diff vs approved        │   ℹ    │ compared against 63e80dedb6d2 │
└────────────────────────────────┴────────┴───────────────────────────────┘

╭─────────────────────────────────── RESULT ───────────────────────────────────╮
│ node24 action — 1 unverified binary download(s) detected (no                 │
│ checksum/signature check in file)                                            │
╰──────────────────────────────────────────────────────────────────────────────╯
Exit code: 1

The RESULT panel now correctly attributes the failure to the binary-download check (tc.downloadTool in src/download/download-version.ts) instead of misleadingly saying "Differences detected between published and rebuilt JS" as in the original PR #724 run. Exit code 1 as expected.