fix(packaging): verify bundled startup dependencies

tests/test_packaging.py

@@ -1,5 +1,7 @@
 import hashlib
 import json
+import subprocess
+import sys
 import tempfile
 import unittest
 from pathlib import Path
@@ -30,6 +32,9 @@ class PackagingTests(unittest.TestCase):
         self.assertIn('"app.default_prompts"', spec)
         self.assertIn('includes=["**/*.txt"]', normalized)
         self.assertIn("datas=default_prompt_datas", normalized)
+        self.assertIn('find_spec("backports.tarfile")', spec)
+        self.assertIn('"backports.tarfile"', spec)
+        self.assertIn("requirements-build.txt", spec)
         self.assertIn("COLLECT(", spec)
         self.assertIn('name="cmshopee"', normalized)
         cover_prompt = self.read_text("app/default_prompts/cover/cover_prompt.txt")
@@ -66,12 +71,35 @@ class PackagingTests(unittest.TestCase):
         self.assertIn("cmshopee.spec", script)
         self.assertIn("Decode-Utf8Base64", script)
 
+    def test_build_requirements_pin_pyinstaller_runtime_dependencies(self):
+        requirements = self.read_text("requirements-build.txt")
+
+        for dependency in (
+            "pyinstaller==6.11.1",
+            "pyinstaller-hooks-contrib==2026.6",
+            "setuptools==80.9.0",
+            "backports.tarfile==1.2.0",
+        ):
+            self.assertIn(dependency, requirements)
+
+    def test_source_startup_smoke_test_imports_gui_and_exits(self):
+        result = subprocess.run(
+            [sys.executable, str(REPO_ROOT / "main.py"), "--startup-smoke-test"],
+            cwd=REPO_ROOT,
+            capture_output=True,
+            text=True,
+            timeout=30,
+            check=False,
+        )
+
+        self.assertEqual(0, result.returncode, result.stderr)
+
     def test_release_version_source_is_single_place(self):
         version_py = self.read_text("app/version.py")
 
         self.assertIn('APP_NAME = "蝦皮圈優化助手"', version_py)
         self.assertIn('APP_CODE_NAME = "cmshopee"', version_py)
-        self.assertRegex(version.APP_VERSION, r"^\d+\.\d+\.\d+$")
+        self.assertRegex(version.APP_VERSION, r"^\d+(?:\.\d+){2,3}$")
         self.assertEqual(
             f"{version.APP_NAME} v{version.APP_VERSION}",
             version.display_name(),
@@ -122,6 +150,14 @@ class PackagingTests(unittest.TestCase):
         self.assertNotIn('release-metadata*.json', script)
         self.assertIn('cmshopee-updater.spec', script)
         self.assertIn('cmshopee-updater.exe', script)
+        self.assertIn("Assert-PackagedStartup", script)
+        self.assertIn("--startup-smoke-test", script)
+        self.assertIn("WaitForExit", script)
+        self.assertIn("Stop-Process", script)
+        self.assertLess(
+            script.index("Assert-PackagedStartup -ExePath"),
+            script.index('$releaseRoot = Join-Path $repoRoot "release"'),
+        )
 
     def test_updater_spec_builds_a_windowed_standalone_executable(self):
         spec = self.read_text("cmshopee-updater.spec")