Add Core Hub operator CLI wrappers

docs/deployment/operator-cli.md

@@ -0,0 +1,46 @@
+# Core Hub Operator CLI
+
+`make operator-cli` runs thin operator wrappers around Core Hub API behavior that
+is already covered by tests and smoke scripts. It does not introduce a second
+implementation path for Core Hub state.
+
+## Commands
+
+Run the deployed API smoke and emit the same non-secret evidence report as
+`make deployed-smoke`:
+
+```bash
+CORE_HUB_BASE_URL=https://core-hub-staging.example.invalid \
+CORE_HUB_OPERATOR_TOKEN_FILE=/secure/operator/path/core-hub-operator-token \
+make operator-cli CLI_ARGS="deployed-smoke --output .local/smoke/core-hub-staging.json"
+```
+
+Summarize ops-hub bootstrap state through protected `/api/v2` routes:
+
+```bash
+CORE_HUB_BASE_URL=https://core-hub-staging.example.invalid \
+CORE_HUB_OPERATOR_TOKEN_FILE=/secure/operator/path/core-hub-operator-token \
+make operator-cli CLI_ARGS="ops-bootstrap-status"
+```
+
+Validate or import a migration bundle using the same migration code as
+`scripts/core_hub_migrate.py`:
+
+```bash
+make operator-cli CLI_ARGS="migration validate /secure/operator/path/interhub-export.bundle.json"
+CORE_HUB_DATABASE_URL=postgresql+asyncpg://... \
+make operator-cli CLI_ARGS="migration import /secure/operator/path/interhub-export.bundle.json --dry-run"
+```
+
+Summarize cutover gates from non-secret evidence reports:
+
+```bash
+make operator-cli CLI_ARGS="readiness-summary \
+  --deployed-smoke-report .local/smoke/core-hub-staging.json \
+  --migration-report .local/migration/interhub-import.json \
+  --activity-core-report .local/smoke/activity-core-core-hub.json"
+```
+
+The readiness summary treats a migration dry-run as open, not cutover-ready. A
+legacy Inter-Hub reference smoke can be supplied with `--inter-hub-report`; it is
+reported as an advisory open gate when omitted.