Finish SAND-WP-0002: remote smoke, podman-compose, HTTP stub

- T10 smoke passed on CoulombCore (sand-boxer self-deploy, sandbox 4e542c51)
- Add e2e smoke compose, scripts/smoke-compose-e2e.sh, make smoke-remote
- Support SANDBOXER_COMPOSE_CMD for podman-compose hosts
- FastAPI v0 stub at sandboxer.api.app; migration gaps doc
- Mark workplan finished (all 10 tasks done)

docs/migration-gaps.md

@@ -0,0 +1,31 @@
+# Migration gaps — SAND-WP-0002 smoke findings
+
+Recorded after SAND-WP-0002-T10 remote verification on CoulombCore (`92.205.130.254`).
+
+**Host findings:** CoulombCore has `podman-compose` (not `docker compose`). Use
+`SANDBOXER_COMPOSE_CMD=podman-compose`. Container images need fully qualified names
+(e.g. `docker.io/library/nginx:alpine`) due to short-name registry policy.
+
+## wise-validator (SAND-WP-0003)
+
+| Legacy (`e2e-framework`) | sand-boxer today | Gap |
+|--------------------------|------------------|-----|
+| Parse `e2e/e2e.yml` health_checks | `wait_ready` uses compose `ps` only | wise-validator must own HTTP health polling |
+| Run `test_command` | Not implemented | wise-validator runs tests inside ready sandbox |
+| `reporter.py` → State Hub pass/fail | Lifecycle events only | wise-validator posts validation results |
+| `make e2e REPO=` one-shot | `create` + separate validate step | Need orchestrated caller or validator CLI |
+
+## the-custodian shim (SAND-WP-0004)
+
+| Legacy | Target |
+|--------|--------|
+| `make e2e REPO=` in the-custodian | Delegate provision/teardown to `sandboxer create/destroy` |
+| `python -m e2e_framework` | Deprecation notice + wrapper |
+| `RUNBOOK.md` in e2e-framework | Point to `docs/runbooks/profile-compose-e2e.md` |
+
+## sand-boxer follow-ons
+
+| Item | Workplan |
+|------|----------|
+| Self-canary + host telemetry | SAND-WP-0008 |
+| Default `sandboxer create` without repo | SAND-WP-0008-T06 |

docs/runbooks/profile-compose-e2e.md

@@ -12,16 +12,23 @@ Provision a compose-based e2e sandbox via `ext.compose-ssh` (e2e-framework linea
 **Remote host** (CoulombCore or sandboxer01)
 
 - SSH access (`SANDBOXER_HOST` or `--host`)
-- Docker + compose plugin
+- Compose runtime: `docker compose` **or** `podman-compose` (CoulombCore uses podman)
 - Sufficient disk for images
 
 ```bash
 export SANDBOXER_HOST=coulombcore          # or 92.205.130.254
+export SANDBOXER_COMPOSE_CMD=podman-compose  # CoulombCore; omit on docker hosts
 # Omit SANDBOXER_SSH_USER to use ~/.ssh/config (CoulombCore: tegwick + id_ops)
-# export SANDBOXER_SSH_USER=tegwick        # only if not in ssh config
-# export SANDBOXER_SSH_KEY=~/.ssh/id_ops   # only to override config
 ```
 
+### Automated smoke (SAND-WP-0002-T10)
+
+```bash
+./scripts/smoke-compose-e2e.sh
+```
+
+Uses sand-boxer `e2e/docker-compose.smoke.yml` (nginx:alpine) — create → ps → destroy → verify cleanup.
+
 ## Create
 
 Target repo must contain `e2e/e2e.yml` (for compose file path) or a