dev.sh funnels build/vet/test/check/events/shell through the
digest-pinned builder (golang:1.26-bookworm @ sha256:e8c859f...; alpine
lacks bash, which the exec tool's tests exec), keeping the host
toolchain-free per the DESIGN dev-in-docker rule. smoke/smoke.sh runs
`harness events` in the container with host port 4100 published and
drives it from the host with python3 stdlib urllib (curl is banned on
host): 401 unsigned/bad-signature/wrong-secret, 200 stored + duplicate
replay, per-provider action mapping, then prints container + JSONL
logs. Throwaway smoke state/ literals live under gitignored .smoke/.
