test: add production compose smoke harness

docs/implementation-plan.v1.md

@@ -189,6 +189,7 @@ scripts/test-integration          [--suite NAME|all] [--run-id ID] [--resume]
 scripts/test-e2e                  [--scenario NAME|all] [--run-id ID] [--resume]
 scripts/test-env                  doctor|coverage|status|logs|collect|recover|reuse|stop|reset|purge|gc ...
 scripts/build                     build|verify|doctor|recover|clean (pinned toolchain; host-safe)
+scripts/test-production-compose   run|clean --run-id ID (loopback production-stack smoke)
 scripts/windows/build-test-bundle --run-id ID --config FILE [--ca FILE]
 scripts/windows/test-host         status|prepare|stage|install|run|collect|stop|reset|recover
 ```

docs/operations-runbook.md

@@ -6,7 +6,8 @@ describe a Unix-like client, which is outside v1.
 ## Deploy and verify
 
 Use the checked-in Compose deployment as the sole Linux-server runtime. Start
-from the annotated [`server.toml`](examples/server.toml) and retain
+from its Compose-specific
+[`server.toml.example`](../deploy/production/server.toml.example) and retain
 `json_rpc.enabled = false` unless performing loopback-only debugging.
 
 For Compose, follow the setup in

docs/testing.md

@@ -193,6 +193,18 @@ Interactive browser access is a deliberately temporary recovery path only. See
 self-signed HTTPS Guacamole lifecycle; it must be started only after the native
 fixture controller has prepared and leased the VM, and stopped before reset.
 
+The Linux production Compose asset has a separate, loopback-only smoke lane. It
+uses a disposable self-signed key only under the ignored `.test-runs` tree,
+starts the real non-root server and nginx services, probes TLS liveness and
+readiness, and invokes `rvc` through the private socket. It leaves compact logs
+and output for inspection, while removing its exact Compose project by default:
+
+```sh
+docker build -f deploy/Dockerfile.runtime -t rvbox-server:test .
+scripts/test-production-compose run --run-id production-smoke
+scripts/test-production-compose clean --run-id production-smoke --purge --yes
+```
+
 The canonical headless VirtualBox/Guest Control adapter is
 `scripts/windows/test-host`. It is a POSIX controller script because the
 fixture's VirtualBox host is Arch Linux and has no PowerShell runtime. The