feat(smoke): VHS tape harness for interactive CLI smoke tests

[Aaronontheweb]

Summary

• Adds a VHS tape-driven smoke test harness that runs alongside the existing non-interactive smoke (scripts/smoke/check.sh), covering the interactive Termina/TUI surface that check.sh cannot reach — the layer where the recent init-wizard regression lived.
• Includes a full init-wizard Personal-posture walkthrough with post-tape assertions on the produced state (netclaw doctor exit code, schema-relevant fields in netclaw.json, identity in SOUL.md).
• Switches the smoke compose from a misplaced named-volume mount at /root/.netclaw to a tmpfs at /home/netclaw/.netclaw (the image's actual USER netclaw home), so smoke runs always start with empty netclaw state and can never collide with a host's ~/.netclaw.

This is a foundation PR — only help.tape and init-wizard.tape land here. Follow-ups will add model-add, provider-add, webhooks-add, reminder-create, and mcp-permissions tapes plus a nightly workflow.

What's new

File	Purpose
scripts/smoke/install-vhs.sh	Pinned VHS install (Linux/x86_64 + apt deps)
scripts/smoke/run-tape.sh	Per-tape wrapper: preamble substitution → vhs run → assertion → artefact collection
scripts/smoke/run-tapes.sh	light / full / single-tape driver shared by CI and local dev (--keep-stack / --no-up)
tests/smoke-interactive/tapes/preamble.tape	Establishes a docker exec session with per-tape NETCLAW_HOME=/tmp/tape-<name>
tests/smoke-interactive/tapes/help.tape	Harness self-test
tests/smoke-interactive/tapes/init-wizard.tape	Full Personal-posture wizard, Wait+Screen only
tests/smoke-interactive/assertions/init-wizard.sh	netclaw doctor + jq field checks + identity/SOUL.md user check
tests/smoke-interactive/tapes/README.md	Authoring conventions (no Sleep, no screenshots, anchor every step)
.github/workflows/smoke_sandbox.yml	New steps after check.sh: install vhs → run light tapes → existing collect/upload still capture artifacts

check.sh is unchanged. The tape harness augments it; it does not replace it. The two cover different slices of the CLI surface (interactive Termina TUI vs HTTP/REST/JSON).

Verified locally and in CI

./scripts/smoke/run-tapes.sh light
# → help: OK
# → init-wizard: OK
#       .Providers.ollama.Type == 'ollama'
#       .Providers.ollama.Endpoint == 'http://ollama:11434'
#       .Models.Main.Provider == 'ollama'
#       .Models.Main.ModelId == 'qwen2:0.5b'
#       .Security.DeploymentPosture == 'Personal'
#       identity/SOUL.md contains 'Name: SmokeTester'

CI confirmed green on this branch — the new "Install vhs" + "Run interactive tapes (light)" steps inside the Smoke Sandbox job complete in ~80 seconds end-to-end.

Notes for reviewers

• VHS pinned to v0.11.0 (minimum that supports Wait+Screen /pattern/).
• netclaw doctor exits 2 in this configuration because Personal posture + HostAllowed shell intentionally trips a WARN. The assertion treats 0 and 2 as success and only fails on 1.
• ExternalSkillsStep is skipped (IsApplicable returns false when no external skill sources are detected); if the smoke image starts seeding Claude Code or similar, init-wizard.tape will need an additional branch.
• The init wizard auto-launches the chat TUI on success; the tape exits chat with Ctrl+Q to drop back to the shell before assertions run.

Test plan

• CI smoke job is green on this branch (the existing smoke checks plus the new interactive tape job).
• Failure-mode reproduction: introduce an intentional break in a wizard prompt on a throwaway branch and confirm init-wizard.tape fails red with a Wait+Screen timeout and an attached PNG of the hung screen. (Not done in this PR.)