tests/firefox: avoid building librewolf

Stub the Librewolf package in module tests so shared Firefox logic still runs without evaluating or building the insecure nixpkgs package.

tests/darwinScrublist.nix

@@ -110,6 +110,8 @@ let
     "less"
     "lesspipe"
     "lf"
+    "librewolf"
+    "librewolf-unwrapped"
     "lieer"
     "lsd"
     "ludusavi"

tests/modules/programs/firefox/librewolf.nix

@@ -1,5 +1,83 @@
 { lib, ... }:
-import ./common.nix {
-  inherit lib;
-  name = "librewolf";
-}
+let
+  tests = import ./common.nix {
+    inherit lib;
+    name = "librewolf";
+  };
+in
+lib.mapAttrs (
+  _: test:
+  { config, pkgs, ... }:
+  let
+    librewolfUnwrapped = config.lib.test.mkStubPackage {
+      name = "browser-unwrapped-test-stub";
+      extraAttrs = {
+        applicationName = "librewolf";
+        binaryName = "librewolf";
+        gtk3 = null;
+        libName = "librewolf";
+        meta.description = "I pretend to be LibreWolf";
+        meta.mainProgram = "librewolf";
+      };
+      outPath = null;
+    };
+
+    mkLibrewolf = lib.makeOverridable (
+      {
+        cfg ? { },
+        extraPolicies ? { },
+        pkcs11Modules ? [ ],
+      }:
+      config.lib.test.mkStubPackage {
+        name = "browser-test-stub";
+        buildScript =
+          let
+            policiesJson = pkgs.writeText "policies.json" (
+              builtins.seq cfg (
+                builtins.seq pkcs11Modules (
+                  builtins.toJSON {
+                    policies = config.programs.librewolf.policies // extraPolicies // { DownloadDirectory = "/foo"; };
+                  }
+                )
+              )
+            );
+          in
+          ''
+            mkdir -p "$out/bin"
+            mkdir -p "$out/lib/librewolf/distribution"
+            mkdir -p "$out/Applications/Librewolf.app/Contents/MacOS"
+            mkdir -p "$out/Applications/Librewolf.app/Contents/Resources/distribution"
+
+            cat > "$out/bin/librewolf" <<'EOF'
+            MOZ_APP_LAUNCHER=
+            EOF
+            chmod 755 "$out/bin/librewolf"
+
+            cp "$out/bin/librewolf" "$out/Applications/Librewolf.app/Contents/MacOS/librewolf"
+            cp ${policiesJson} "$out/lib/librewolf/distribution/policies.json"
+            cp ${policiesJson} "$out/Applications/Librewolf.app/Contents/Resources/distribution/policies.json"
+          '';
+        extraAttrs = {
+          browserName = "librewolf";
+          meta.mainProgram = "librewolf";
+          unwrapped = librewolfUnwrapped;
+        };
+      }
+    ) { };
+  in
+  {
+    imports = [ test ];
+
+    # Librewolf is insecure in nixpkgs; use a small wrapper-shaped package and
+    # skip its generated native messaging host join so module tests do not
+    # evaluate or build the real browser closure.
+    nixpkgs.overlays = [
+      (_: _: {
+        librewolf = mkLibrewolf;
+        librewolf-unwrapped = librewolfUnwrapped;
+      })
+    ];
+    mozilla.librewolfNativeMessagingHosts = lib.mkForce [ ];
+    programs.librewolf.package = lib.mkDefault mkLibrewolf;
+  }
+) tests