fix(WS-25): repoint the deploy guards at the extracted apply script

[vjvarada]

What broke

Extracting DEPLOY_SCRIPT into scripts/vps_apply.sh (#359) broke test_meeting_bot_deploy_wiring.py. Seven of its guards grep the deploy script's content and were reading .github/workflows/deploy.yml, where that content no longer lives.

CI caught it — 1 failed, 1883 passed — and correctly skipped publish-release, so the box was never offered a build whose tests failed. That is the new gate doing exactly what it was built for, on its first run.

Fix

All eleven asserted strings were verified present in vps_apply.sh and absent from deploy.yml before repointing anything, so this follows the subject rather than relaxing the assertion.

The guard that makes the other seven mean anything

test_both_delivery_paths_execute_the_same_apply_script. The seven guards now read a file; that is only meaningful while something actually runs it. Without this, re-inlining the script into the workflow would leave every guard green against an orphan while the real deploy logic lived elsewhere — precisely the drift the extraction exists to prevent.

It pins both consumers (workflow → push path, poller → pull path) and asserts DEPLOY_SCRIPT is not reintroduced alongside, because two copies are worse than either alone.

⚠️ My first version of that guard was itself too weak

assert "scripts/vps_apply.sh" in workflow — a bare substring check. Mutating the workflow to copy a different file left it green, because the header comments discuss vps_apply.sh by name. It certified the documentation, not the wiring.

Now it requires a non-comment line. Three mutants measured red, tree byte-identical after revert:

Mutant	Result
workflow copies a different file	🔴 red
poller runs its own private copy	🔴 red
script re-inlined as DEPLOY_SCRIPT	🔴 red

13 passed at baseline.

🤖 Generated with Claude Code