Add deployed API smoke harness

tests/test_deployed_smoke.py

@@ -0,0 +1,39 @@
+import json
+
+from core_hub.smoke import run_smoke
+
+
+def test_deployed_smoke_harness_emits_non_secret_evidence(client):
+    report = run_smoke(
+        client,
+        base_url="http://testserver",
+        operator_token="operator-token",
+        run_id="pytest",
+    )
+
+    assert report["ok"] is True
+    assert report["failures"] == []
+
+    check_names = {check["name"] for check in report["checks"]}
+    assert "healthz" in check_names
+    assert "readyz" in check_names
+    assert "openapi-json" in check_names
+    assert "catalog:widget-types" in check_names
+    assert "protected-401:hubs" in check_names
+    assert "operator-auth:hubs" in check_names
+
+    bootstrap = report["bootstrap"]
+    assert bootstrap["hub"]["slug"] == "ops-hub-smoke-pytest"
+    assert bootstrap["manifest"]["status"] == "active"
+    assert bootstrap["apiConsumer"]["keyPrefix"].startswith("ch_")
+    assert bootstrap["runtimeKey"]["created"] is True
+    assert bootstrap["runtimeKey"]["keyPrefix"].startswith("ch_")
+    assert bootstrap["widgets"]["created"] == 1
+    assert bootstrap["event"]["eventType"] == "ops-endpoint-verified"
+    assert bootstrap["interactionEvents"]["containsEvent"] is True
+    assert bootstrap["hubRegistry"]["containsHub"] is True
+    assert bootstrap["hubRegistry"]["containsManifest"] is True
+
+    rendered = json.dumps(report, sort_keys=True)
+    assert "operator-token" not in rendered
+    assert "fullKey" not in rendered