test(flows): tighten live OBOL smoke

[bussyjd]

Summary

• supersedes fix(stack): reuse cached dev images on stack up #400 by including the dev-image cache reuse opt-in for smoke runs
• makes live OBOL release smoke explicit via flow-14-live-obol-base-sepolia.sh, with the Anvil fork path kept separately as flow-13-dual-stack-obol.sh
• switches flow-14 back to the deterministic Bob buyer wallet model used by flow-11; the flow now pre-seeds Bob's remote-signer and no longer funds a generated signer
• adds the shared runtime-aware agent_auth_token helper for OBOL flows
• bumps cloudflare/cloudflared to 2026.3.0 and adds Renovate tracking for that image
• compresses the Obol stack dev skill into a compact router with focused references for live OBOL QA, remote QA worktrees, and paid-commerce gotchas

Validation

• git diff --check
• bash -n flows/*.sh
• jq empty renovate.json
• helm lint internal/embed/infrastructure/cloudflared
• helm template cloudflared internal/embed/infrastructure/cloudflared | rg 'cloudflare/cloudflared:2026\\.3\\.0'
• go test ./internal/stack -run 'TestBuildAndImportLocalImages_(DefaultBuildsEvenWhenImageExists|ReusesExistingImageWhenOptedIn)' -count=1
• go test ./cmd/obol ./internal/tunnel ./internal/stack ./internal/hermes -count=1

QA Notes

A prior remote run of flow-14 passed end-to-end on Base Sepolia with the deployed OBOL token and public facilitator, including purchase, paid inference, settlement transfer, exact balance deltas, and cleanup. After the deterministic-Bob correction in this PR, I did not rerun the full live flow because both QA machines' deterministic Bob wallets currently have 0 OBOL, so the updated flow would fail early until those wallets are topped up.

[bussyjd]

Summary

What changed:

• supersedes fix(stack): reuse cached dev images on stack up #400 by moving cached dev-image reuse behind an explicit smoke-harness opt-in
• tightens the live OBOL smoke path (flows/flow-14-live-obol-base-sepolia.sh) and keeps the fork regression path separate in flows/flow-13-dual-stack-obol.sh
• restores deterministic Bob wallet handling for the live OBOL flow and centralizes shared auth-token flow helpers
• adds QA-focused maintainer docs/skill references plus a QA-oriented PR template
• updates cloudflare/cloudflared to 2026.3.0 and tracks it in Renovate

Why it matters:

• makes live OBOL QA expectations explicit and easier to review
• reduces smoke-run flakiness without changing default developer rebuild semantics in internal/stack
• preserves deterministic buyer funding/signing assumptions across the live QA flows

Risk level: medium

Commit under test:

• 4dfca213496b252c24c18dd61925d9bdbe0af216

Base branch:

• main

Scope

• Code
• Charts / manifests
• Flows / QA scripts
• Docs / skills
• Images / dependencies
• Other:

Validation

CI checks:

Check	Status	Link
Analyze (actions)	pass	https://github.com/ObolNetwork/obol-stack/actions/runs/25153101341/job/73728150600
Analyze (go)	pass	https://github.com/ObolNetwork/obol-stack/actions/runs/25153101341/job/73728150589
Analyze (javascript-typescript)	pass	https://github.com/ObolNetwork/obol-stack/actions/runs/25153101341/job/73728150587
Analyze (python)	pass	https://github.com/ObolNetwork/obol-stack/actions/runs/25153101341/job/73728150701
CodeQL	pass	https://github.com/ObolNetwork/obol-stack/runs/73728253179
lint-test	pass	https://github.com/ObolNetwork/obol-stack/actions/runs/25153103431/job/73728155005

Unit tests:

commit: 4dfca213496b252c24c18dd61925d9bdbe0af216
command: go test ./... -count=1
result: PASS

command: go test ./cmd/obol ./internal/tunnel ./internal/stack ./internal/hermes -count=1
result: PASS

command: go test ./internal/stack -run 'TestBuildAndImportLocalImages_(DefaultBuildsEvenWhenImageExists|ReusesExistingImageWhenOptedIn)' -count=1
result: PASS

Integration tests:

No separate Go integration-tag suite rerun in this maintainer pass.

Flow tests:

Flow	Network	QA machine label	Worktree	Result	Artifacts
bash -n flows/*.sh	local syntax	macOS maintainer machine	.worktrees/pr401-qa-20260430-153420	PASS	local shell syntax only
flow-14-live-obol-base-sepolia.sh	Base Sepolia / OBOL	prior remote QA run (author note)	see PR body	not rerun in this maintainer pass	see PR body QA Notes

Release smoke:

Not rerun in this maintainer pass.

Live Chain Evidence

Do not include private keys, seed phrases, passwords, hostnames, personal paths, or raw bearer tokens.

Network:

• not rerun in this maintainer pass

RPC/provider:

• not rerun in this maintainer pass

Facilitator:

• not rerun in this maintainer pass

Contracts and tokens:

Name	Address	Version / notes
OBOL (live flow target)	not revalidated in this pass	see PR body / flow-14 defaults

Wallet roles:

Role	Address	Source
Alice / seller / register	not revalidated in this pass	see PR body / QA notes
Bob / buyer / payer	not revalidated in this pass	see PR body / QA notes
Facilitator / receiver	not revalidated in this pass	see PR body / QA notes

Balances:

Token	Address	Before	After	Expected delta	Actual delta
not rerun

Transaction receipts:

Purpose	Tx hash	From	To	Amount / event	Status
ERC-8004 registration	not rerun
Metadata / service offer	not rerun
Approval / permit	not rerun
Purchase request	not rerun
Settlement transfer	not rerun

Runtime Evidence

QA environment:

Item	Value
OS / arch	macOS 26.3.1 (a), Darwin arm64
Backend	local verification only; no fresh stack deployment completed in this pass
Tool versions	go1.25.5, helm v4.0.4+g8650e1d, jq 1.7.1
QA agent/model	n/a

Images:

Component	Image	Tag / digest	Source
cloudflared	cloudflare/cloudflared	2026.3.0	verified via helm template cloudflared internal/embed/infrastructure/cloudflared

Kubernetes / stack:

Item	Value
Stack IDs	n/a in this maintainer pass
Namespaces	n/a in this maintainer pass
Pod readiness	n/a in this maintainer pass
Cleanup result	n/a in this maintainer pass

Model and routing:

Item	Value
Agent/model used	n/a
LiteLLM route	not rerun
Paid endpoint status	not rerun
Auth token source	flow helper changes reviewed; not rerun live

Artifacts and logs:

Artifact	Location / link	Notes
PR CI runs	links above	all green at time of comment
local validation output	maintainer terminal session	not committed to repo

Demo readiness:

Item	Status	Notes
Seller visible / registered	not rerun	see PR body QA Notes
Buyer discovery works	not rerun	see PR body QA Notes
Paid route works	not rerun	see PR body QA Notes
Settlement visible on-chain	not rerun	see PR body QA Notes

Review Notes

Known gaps:

• git diff --check origin/main...HEAD reports two markdown formatting nits:
  • .agents/skills/obol-stack-dev/references/paid-commerce.md:84: new blank line at EOF
  • .agents/skills/obol-stack-dev/references/remote-qa.md:82: new blank line at EOF
• these did not affect CI; all GitHub checks and local test commands above were green

Follow-ups:

• optionally trim the two EOF blank-line nits in a follow-up commit if you want git diff --check to be completely clean locally

Reviewer focus:

• deterministic Bob wallet assumptions in flow-14
• smoke-harness-only cache reuse scoping vs default developer rebuild semantics
• QA docs/skill routing consistency across flow-11, flow-13, and flow-14