ci: harden inter-hub production smoke gate

workplans/IHUB-WP-0018-railiance01-deployment.md

@@ -392,6 +392,13 @@ workplans, `.custodian-brief.md`, `app.toml`, `.sops.yaml`, and
 `deploy/railiance/**` so State Hub consistency/doc-only commits do not consume a
 haskelseed build/deploy cycle.
 
+**Bootstrap-gate deploy note (2026-06-14):** Hardened the deployment workflow
+smoke test so a production rollout only passes when `/api/v2/hubs` returns the
+expected unauthenticated `401` and OpenAPI exposes `/hubs`,
+`/hub-capability-manifests`, `/api-consumers`, and `/policy-scopes`. This
+directly protects the ops-hub bootstrap gate instead of only checking the
+landing page and generic widget auth gate.
+
 ### R8 — Staged deployment and smoke test
 
 ```task