feat: reachability and consumer profiles (SAND-WP-0011)

Add reachability enrichment (tunnel metadata, ops-bridge pointer),
secret_refs boundary resolution, profile.agent-dev and profile.build,
CLI reachability show, API endpoint, consumer smoke scripts, and tests.

docs/integrations/glas-harness.md

@@ -31,6 +31,16 @@ sandboxer create \
 | SSH / tunnel reachability setup | glas-harness + ops-bridge |
 | Agent memory and session state | glas-harness |
 
+## Smoke test
+
+```bash
+# Requires sandboxer CLI and SANDBOXER_HOST (or profile placement fallback)
+SANDBOXER_HOST=coulombcore ./scripts/smoke-agent-dev.sh
+```
+
+Creates `profile.agent-dev`, prints reachability (tunnel metadata + SSH
+one-liner), then destroys.
+
 ## Out of scope for sand-boxer
 
 - Tool schemas and approval flows