ci(vulkan-smoke): pin macos runtime provisioning

.github/workflows/ci.yml

@@ -55,8 +55,11 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: macos-latest
+          - os: macos-15
             smoke_platform: macos
+            runner_arch: arm64
+            moltenvk_version: 1.4.1
+            vulkan_sdk_version: 1.4.350.1
     env:
       CARGO_TERM_COLOR: always
     steps:
@@ -65,6 +68,48 @@ jobs:
         with:
           toolchain: 1.87.0
           components: clippy,rustfmt
+      - name: Provision macOS Vulkan runtime
+        shell: bash
+        run: |
+          set -euo pipefail
+          brew install molten-vk vulkan-loader vulkan-tools vulkan-validationlayers
+          test "$(uname -m)" = "${{ matrix.runner_arch }}"
+          ruby <<'RUBY'
+          require "json"
+
+          expected = {
+            "molten-vk" => "${{ matrix.moltenvk_version }}",
+            "vulkan-loader" => "${{ matrix.vulkan_sdk_version }}",
+            "vulkan-tools" => "${{ matrix.vulkan_sdk_version }}",
+            "vulkan-validationlayers" => "${{ matrix.vulkan_sdk_version }}",
+          }
+          payload = JSON.parse(`brew info --json=v2 #{expected.keys.join(" ")}`)
+          actual = payload.fetch("formulae").to_h do |formula|
+            [formula.fetch("name"), formula.fetch("versions").fetch("stable")]
+          end
+          mismatches = expected.each_with_object({}) do |(name, version), out|
+            actual_version = actual[name]
+            next if actual_version == version
+
+            out[name] = {
+              "expected" => version,
+              "actual" => actual_version,
+            }
+          end
+          unless mismatches.empty?
+            warn JSON.pretty_generate(mismatches)
+            abort "unexpected macOS Vulkan formula version"
+          end
+          RUBY
+          HOMEBREW_PREFIX="$(brew --prefix)"
+          VK_ICD_FILENAMES="$HOMEBREW_PREFIX/opt/molten-vk/etc/vulkan/icd.d/MoltenVK_icd.json"
+          VK_LAYER_PATH="$HOMEBREW_PREFIX/opt/vulkan-validationlayers/share/vulkan/explicit_layer.d"
+          DYLD_FALLBACK_LIBRARY_PATH="$HOMEBREW_PREFIX/opt/vulkan-loader/lib:$HOMEBREW_PREFIX/opt/molten-vk/lib"
+          test -f "$VK_ICD_FILENAMES"
+          test -d "$VK_LAYER_PATH"
+          echo "VK_ICD_FILENAMES=$VK_ICD_FILENAMES" >> "$GITHUB_ENV"
+          echo "VK_LAYER_PATH=$VK_LAYER_PATH" >> "$GITHUB_ENV"
+          echo "DYLD_FALLBACK_LIBRARY_PATH=$DYLD_FALLBACK_LIBRARY_PATH" >> "$GITHUB_ENV"
       - name: Install cargo-deny
         run: cargo install cargo-deny --version 0.19.9 --locked
       - name: Run canonical CI gate