feat: alive UI wave, galaxy presence, spread and fleet enhancements

Dashboard ambient layer, comrade presence, Mission Deck and War Room, Emberwake supply chain, spread/docs publishing, fleet policy and modules API, CI docker mining, and refreshed USB pack.

scripts/smoke-test.ps1

@@ -2,12 +2,23 @@
 param(
     [string]$BaseUrl = "http://localhost:8989",
     [string]$Username,
-    [string]$Password
+    [string]$Password,
+    [string]$FleetSecret,
+    [string]$DataDir
 )
 
 if (-not $Username) { $Username = if ($env:AETHERFORGE_E2E_USER) { $env:AETHERFORGE_E2E_USER } else { "testuser" } }
 if (-not $Password) { $Password = if ($env:AETHERFORGE_E2E_PASS) { $env:AETHERFORGE_E2E_PASS } else { "testpass" } }
 
+if (-not $FleetSecret) { $FleetSecret = $env:AETHERFORGE_FLEET_SECRET }
+if (-not $FleetSecret -and $DataDir) {
+    $cfgPath = Join-Path $DataDir "config.json"
+    if (Test-Path $cfgPath) {
+        $cfg = Get-Content $cfgPath -Raw | ConvertFrom-Json
+        if ($cfg.server.fleet_secret) { $FleetSecret = $cfg.server.fleet_secret }
+    }
+}
+
 $ErrorActionPreference = "Stop"
 $passed = 0
 $failed = 0
@@ -17,6 +28,28 @@ $results = @()
 $cred = [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes("${Username}:${Password}"))
 $authHeaders = @{ Authorization = "Basic $cred" }
 
+
+function Invoke-AgentRestMethod {
+    param(
+        [string]$Uri,
+        [string]$Method = "Post",
+        [string]$Body,
+        [string]$ContentType = "application/json"
+    )
+    if (-not $FleetSecret) { throw "fleet secret required for agent API; pass -FleetSecret, -DataDir, or set AETHERFORGE_FLEET_SECRET" }
+    $headers = @{ "X-Fleet-Secret" = $FleetSecret }
+    $params = @{
+        Uri     = $Uri
+        Method  = $Method
+        Headers = $headers
+    }
+    if ($Body) {
+        $params.Body = $Body
+        $params.ContentType = $ContentType
+    }
+    return Invoke-RestMethod @params
+}
+
 function Invoke-AuthRestMethod {
     param(
         [string]$Uri,
@@ -109,15 +142,18 @@ Invoke-SmokeTest "B-07" "POST /agent/decide" {
         shares_bad = 0
     } | ConvertTo-Json -Depth 5
     try {
-        Invoke-RestMethod "$BaseUrl/api/v1/agent/decide" -Method Post -Body $body -ContentType "application/json" | Out-Null
+        Invoke-AgentRestMethod "$BaseUrl/api/v1/agent/decide" -Body $body | Out-Null
     } catch {
-        if ($_.Exception.Response.StatusCode.value__ -ge 500) { throw $_ }
+        $code = $_.Exception.Response.StatusCode.value__
+        if ($code -eq 403) { return }
+        if ($code -ge 500) { throw $_ }
+        throw $_ 
     }
 }
 
 Invoke-SmokeTest "B-08" "POST /agent/report array" {
     $body = '[{"agent_id":"smoke-agent","tool":"sleep","success":true,"output":"ok"}]'
-    $r = Invoke-RestMethod "$BaseUrl/api/v1/agent/report" -Method Post -Body $body -ContentType "application/json"
+    $r = Invoke-AgentRestMethod "$BaseUrl/api/v1/agent/report" -Body $body
     if (-not $r.success) { throw "report not accepted" }
 }