The end-to-end harness

Set up "week three" for running coding agents unattended in this repository:
the smallest end-to-end harness that replaces a person's click-through after
a deploy. Work through the steps in order. Nothing leaves this repo and
nothing is pushed.

1. Your harness. Name the agent tool you are running in and its version.
   Find its documentation (built-in help, local docs, or the official site;
   reading it online is fine). Quote only text you read word for word, label
   anything else as your own knowledge, and say "none" where it has none:
   a. how it runs a long command in the background and reads its result
      when it finishes, without polling;
   b. the longest a single foreground command may run;
   c. whether it can start a CI workflow and read that run's result.

2. This repo. Find what the product consumes (telemetry, events, orders,
   documents, requests), and where that input comes from in production.
   Find any simulator, generator, seed data or recorded fixtures; the
   public API the product exposes and how a client authenticates; every
   non-production environment and its URL; the CI config. Name the file
   you learned each fact from. List checks that already fail; don't fix
   them. Then decide what you can build, and say why:
   - No product code: build nothing.
   - Code but no simulator: build cards 1 and 2 only from the input
     schema you read in the code. Never invent an input schema.
   - No non-production environment with a public API: build nothing for
     cards 3 to 5.
   In every case still send step 3's questions; then the gap report says
   what each missing piece would need.

3. Questions. Put everything you could not find in ONE message to me:
   which non-production environment a replay may use and how to get
   ordinary-user credentials for it; which single fault to simulate
   first and what the product must do about it; whether a replay can
   create and remove its own sandbox (a tenant, account, namespace or
   preview environment) through the API, and if not, which fixed test
   account it may use instead. If nobody answers, continue on stated
   assumptions and mark each one ASSUMED in the final report. Never
   assume credentials or an environment URL; a missing one stops the
   replay, not the report.

4. The cards. Build the smallest version: one scenario, one fixture, one
   presence and one absence assertion, one workflow started by hand. For
   each card name the layer and the file, and propose the change as a diff.
   Card 1: a seeded, deterministic scenario that declares what moves,
           what stays flat, and what must and must not happen. Strongest
           here: a test that runs it twice with one seed and requires
           identical output.
   Card 2: a capture script that refuses a dirty tree and writes the
           records plus a summary of commit, seed and phase boundaries.
           Strongest here: a CI check that fails a pull request changing
           a scenario without recapturing its fixture. If the repo has no
           CI, put the check in the gap report instead of writing it.
   Card 3: a replay that uses only the public API, as an ordinary user,
           in its own sandbox: create it, feed in the fixture, assert and
           do any step a person would at each phase, and remove the
           sandbox at the end, pass or fail. With no sandbox to create,
           use the fixed test account, tag every record the replay makes,
           and purge the tagged records at the end.
   Card 4: assertions on outcomes, never on generated prose, in a
           per-fixture manifest with a fixed grammar; presence and
           absence both; known failures listed with a ticket, flipping to
           hard failures once they stop reproducing.
   Card 5: a CI workflow, started by hand, that runs the replay and keeps
           its results, logs and timings as artifacts for 30 days. Name
           what would schedule it nightly from outside CI; don't set it up.

5. Write the files on a new local branch, inside this repo only, and
   commit. If nobody answers, that commit is your proposal; I review it
   there. Never push or merge. Run the determinism test and the capture
   once (commit first, since capture refuses a dirty tree). Run the
   replay once against the non-production environment only if you have
   its URL and credentials; run it in the background, read its result,
   and show the output. Never run it against production. For anything
   outside the repo (credentials, CI secrets, the scheduler, the
   environment itself), write the exact steps for me instead.

6. End with a gap report, one row per card: card, layer used, file,
   whether it ran and what it printed, what is still missing, and every
   ASSUMED item.