dev.sh + smoke: docker-routed dev loop and webhook smoke test

dev.sh funnels build/vet/test/check/events/shell through the
digest-pinned builder (golang:1.26-bookworm @ sha256:e8c859f...; alpine
lacks bash, which the exec tool's tests exec), keeping the host
toolchain-free per the DESIGN dev-in-docker rule. smoke/smoke.sh runs
`harness events` in the container with host port 4100 published and
drives it from the host with python3 stdlib urllib (curl is banned on
host): 401 unsigned/bad-signature/wrong-secret, 200 stored + duplicate
replay, per-provider action mapping, then prints container + JSONL
logs. Throwaway smoke state/ literals live under gitignored .smoke/.

dev.sh

@@ -0,0 +1,61 @@
+#!/bin/sh
+# MOPAC harness dev wrapper. EVERY compile/vet/test path routes through the
+# digest-pinned Docker builder (DESIGN "ALL dev work in Docker" — big rule);
+# the host runs containers, never toolchains.
+#
+# Usage: ./dev.sh {build|vet|test|check|events|smoke|shell} [args...]
+#
+#   build    compile ./cmd/harness into bin/harness
+#   vet      go vet ./...
+#   test     go test ./...
+#   check    build + vet + test (the pre-commit gate)
+#   events   run `harness events` with host port 4100 published (LAN smoke)
+#   smoke    full webhook smoke: starts events in a container, POSTs via
+#            python urllib (curl is banned on host), shows 401/200 + JSONL,
+#            tears the container down
+#   shell    interactive sh inside the builder
+set -e
+
+IMAGE="golang@sha256:e8c859f5632dcfde7b32d2012b4351728f6437930887c2f6a91ea242459e5514" # = golang:1.26-bookworm (bash present; alpine lacks it)
+
+run() {
+    docker run --rm -v "$PWD:/h" -w /h \
+        -u "$(id -u):$(id -g)" -e HOME=/tmp -e GOFLAGS=-buildvcs=false \
+        "$IMAGE" "$@"
+}
+
+cmd=${1:-check}
+shift || true
+
+case "$cmd" in
+build)
+    run go build -o bin/harness ./cmd/harness
+    ;;
+vet)
+    run go vet ./...
+    ;;
+test)
+    run go test "$@" ./...
+    ;;
+check)
+    run sh -c 'go build -o bin/harness ./cmd/harness && go vet ./... && go test ./...'
+    ;;
+events)
+    # Publish 4100 on the host LAN; state dir bind-mounted from the repo.
+    exec docker run --rm --name mopac-events -p 4100:4100 \
+        -v "$PWD:/h" -w /h -u "$(id -u):$(id -g)" -e HOME=/tmp \
+        -e HARNESS_REDMINE_WEBHOOK_SECRET -e HARNESS_DISCOURSE_WEBHOOK_SECRET \
+        -e HARNESS_GITEA_WEBHOOK_SECRET \
+        "$IMAGE" /h/bin/harness events -listen ":4100" "$@"
+    ;;
+smoke)
+    ./smoke/smoke.sh
+    ;;
+shell)
+    run sh
+    ;;
+*)
+    echo "dev.sh: unknown command $cmd (build|vet|test|check|events|smoke|shell)" >&2
+    exit 1
+    ;;
+esac