fix: qualify production smoke against published runtime [skip deploy]

[lyyzka]

The production smoke still required reasoningRuntime: null, so it rejected the published LingxiOS runtime and could accept the retired contract. Validate every public package version instead, retain release SHA/tenant/WebSocket checks, and avoid printing HTTP error bodies. Route these script changes to the existing deployment-contract CI job.

Validation: four smoke CLI contracts were red before the fix; the selector contract was red before CI wiring; all 22 deployment/smoke contracts now pass. Six affected Compose files validate with synthetic values. This transport fixture does not claim a production smoke pass.

Production delivery is authorized, but this cloud executor currently lacks the existing Sigillo/Komodo identity injection and authenticated smoke session. The public entrypoint is reachable; observed production still runs commit 9332947e099d27b7716236a99604fc548059f6ad, runtime 3.4.7/schema11. No production mutation occurred. The committed admission receipt records the txy3 handoff boundary, migration/drain conditions and remaining formal rollout sequence. Original 3.5.1 soak remains untouched.

Use [skip deploy] for this corrective merge until authenticated preflight succeeds. This does not remove the newly authorized production-delivery objective.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-17T08:54:50.775325Z	89dff57	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[lyyzka]

生产交付准入补充（合并前报告）：PR176最终HEAD 950adc0d32fcc79faf0f8765d9d1139919b918a4，只修改发布烟测、CI接线和准入证据；没有修改产品/runtime逻辑。修复公开runtime版本断言并保留SHA、租户和认证WebSocket检查；不输出HTTP错误响应正文。已审查最终差异，无新增阻塞性代码问题。

本地：完整SPA6/6（PR175证据）、本次部署/烟测契约22/22、6份Compose配置通过。最终PR CI SUCCESS，见 https://github.com/LingXi-Org/LingxiLoop/actions/runs/39019058123 ，实际执行部署契约，integration按作用域跳过。将以普通合并和[skip deploy]交付准入修复，不绕过分支保护。

用户已追加生产部署授权；当前执行器尚无Sigillo/km或Komodo API/webhook注入，也无现有认证烟测会话。认证txy3资源核验、生产schema/排空/备份复核和正式rollout尚未执行。公开生产仍是9332947e / LingxiOS3.4.7 schema11，health/dependencies为200。请恢复既有云端身份注入（不创建凭据、不在聊天发送秘密）；我继续统一负责正式发布，避免其他线程重复触发。

原3.5.1 soak及既有独立复查保持不变。3.5.2完整Worker/真实provider/耐久验证未冒充通过。详细准入证据：docs/evidence/production-admission-20261017/。