dev.sh + smoke: docker-routed dev loop and webhook smoke test

dev.sh funnels build/vet/test/check/events/shell through the
digest-pinned builder (golang:1.26-bookworm @ sha256:e8c859f...; alpine
lacks bash, which the exec tool's tests exec), keeping the host
toolchain-free per the DESIGN dev-in-docker rule. smoke/smoke.sh runs
`harness events` in the container with host port 4100 published and
drives it from the host with python3 stdlib urllib (curl is banned on
host): 401 unsigned/bad-signature/wrong-secret, 200 stored + duplicate
replay, per-provider action mapping, then prints container + JSONL
logs. Throwaway smoke state/ literals live under gitignored .smoke/.

smoke/smoke.sh

@@ -0,0 +1,74 @@
+#!/bin/sh
+# Webhook receiver smoke test: starts `harness events` in the digest-pinned
+# builder container with host port 4100 published, drives it from the host
+# with python urllib (curl is banned on the host by policy), prints the
+# container log + the JSONL event record, then tears everything down.
+set -e
+cd "$(dirname "$0")/.."
+
+IMAGE="golang@sha256:e8c859f5632dcfde7b32d2012b4351728f6437930887c2f6a91ea242459e5514" # = golang:1.26-bookworm (bash present; alpine lacks it)
+NAME="mopac-events-smoke"
+PORT="${PORT:-4100}"
+
+./dev.sh build
+
+rm -rf .smoke
+mkdir -p .smoke
+cat > .smoke/harness.toml <<'EOF'
+# smoke config: throwaway literals only, state kept under .smoke/
+vertical = "smoke"
+work_root = "."
+report_dir = ".smoke/reports"
+
+[loop]
+max_rounds = 2
+
+[litellm]
+base_url = "http://127.0.0.1:9"
+key_ref = "literal:unused-smoke-key"
+
+[models]
+mopac-primary = "glm-5.3"
+default_tier = "mopac-primary"
+
+[demo]
+id = "smoke"
+subject = "smoke"
+prompt = "smoke"
+class = "primary"
+
+[events]
+listen = ":4100"
+state_dir = ".smoke/state"
+
+[events.redmine]
+secret_ref = "literal:smoke-redmine-secret"
+
+[events.discourse]
+secret_ref = "literal:smoke-discourse-secret"
+
+[events.gitea]
+secret_ref = "literal:smoke-gitea-secret"
+EOF
+
+docker rm -f "$NAME" >/dev/null 2>&1 || true
+docker run -d --name "$NAME" -p "$PORT:4100" \
+    -v "$PWD:/h" -w /h -u "$(id -u):$(id -g)" -e HOME=/tmp \
+    "$IMAGE" /h/bin/harness events -config /h/.smoke/harness.toml -listen ":4100"
+
+cleanup() {
+    docker rm -f "$NAME" >/dev/null 2>&1 || true
+}
+trap cleanup EXIT
+
+echo "--- probing http://127.0.0.1:$PORT (python urllib; curl banned on host) ---"
+BASE_URL="http://127.0.0.1:$PORT" python3 smoke/probe.py
+probe_rc=$?
+
+echo "--- container log ---"
+docker logs "$NAME" 2>&1
+
+echo "--- event log (.smoke/state/events.jsonl) ---"
+cat .smoke/state/events.jsonl
+
+exit "$probe_rc"