test(release): add cli smoke readiness checks

[VelariumAI]

Summary

Adds RR-002, a local CLI smoke and config/profile matrix readiness layer.

What changed

• Added RR-002 smoke script:
  • scripts/release_readiness/rr002_cli_smoke.sh
• Added RR-002 smoke test:
  • scripts/release_readiness/test_rr002_smoke.sh
• Added release-readiness profile matrix test:
  • pkg/profile/release_readiness_matrix_test.go
• Integrated RR-002 into:
  • scripts/release_readiness/readiness.sh
• Updated release readiness docs:
  • docs/release/README.md
• Updated promotion manifest / allowlist for new managed files.

Operational posture

• Local and report-only.
• Does not call providers.
• Does not call network endpoints.
• Does not execute app tools.
• Does not create, move, or delete tags.
• Does not run release workflows.
• Does not publish releases.
• Does not modify runtime behavior.
• Does not modify vector/semantic-memory behavior.
• Does not modify private scanner artifacts.
• Does not modify private contracts.
• Does not start RR-003+ tooling.

RR-002 behavior

RR-002 checks safe CLI/help behavior and config/profile invariants.

Safe CLI smoke currently covers:

• gorkbot --help
• gorkbot -h
• gorkweb --help
• gorkweb -h

Unsupported or unsafe commands are skipped/deferred:

• --version
• bare version
• setup/config/configure/status/bare runtime startup

RR-002 writes reports to:

.local/release-readiness/rr002/

Current RR-002 recommendation:

RR002_INCOMPLETE

because version commands are unsupported/deferred. This is expected and honest.

Config/profile matrix

The matrix verifies:

• beginner
• standard
• power_user
• expert
• lab
• enterprise
• custom
• unknown

It covers trace/harness mode posture and verifies:

• unknown profile remains conservative
• automatic promotion remains disabled by default except explicit advanced config surfaces
• release authority remains explicit
• vector retrieval remains candidate-only
• vector_assert_truth is denied / not treated as truth or authority
• custom profile requires explicit marker
• policy absence is not permission

Main readiness integration

readiness.sh now includes RR-002 and still returns:

NEEDS_RR_SUITE

because RR-003+ remain deferred.

It does not claim RC_READY or STABLE_READY.

Review status

Independent review verdict: APPROVE WITH MINOR FIXES.

Focused re-review verdict after fix: APPROVE.

The follow-up fix removed hardcoded /tmp usage from test_rr002_smoke.sh and made the smoke test portable to Termux/Android via ${TMPDIR:-/tmp} + mktemp.

Validation

• bash scripts/release_readiness/test_smoke.sh passed.
• bash scripts/release_readiness/test_rr002_smoke.sh passed.
• bash scripts/release_readiness/rr002_cli_smoke.sh passed with RR002_INCOMPLETE.
• bash scripts/release_readiness/readiness.sh passed with NEEDS_RR_SUITE.
• bash scripts/check_promotion_manifest.sh passed with 908 / 908 managed files.
• Targeted package tests passed.
• go test ./... passed.
• go vet ./... passed.
• git diff --check passed.
• Private scanner finding zero_proofs_3 | reasoning/ classified as existing unrelated.

Deferred follow-ups

• RR-003 VAR spine fixture smoke.
• RR-004 policy absence + statelock/paradox smoke.
• RR-005 vector/RAG/engram preservation smoke.
• RR-006 scripted user/operator session simulation.
• RR-007 final release report generator.