fix(auth): close Task 15 review round two

scripts/authentication-smoke.sh

@@ -30,6 +30,7 @@ output="$temporary_root/playwright"
 mkdir -p "$output"
 sentinel="task15-sentinel-$(openssl rand -hex 24)"
 export THT_TASK15_SENTINEL="$sentinel"
+readonly browser_specs=(e2e/auth.spec.ts e2e/f1.spec.ts)
 
 sanitize_failure_log() {
   sed -E \
@@ -41,7 +42,7 @@ sanitize_failure_log() {
 
 if ! (
   cd "$root/frontend"
-  THT_E2E_AUTH_STACK=1 "$playwright" test e2e/auth.spec.ts --workers=1 --output="$output"
+  THT_E2E_AUTH_STACK=1 "$playwright" test "${browser_specs[@]}" --workers=1 --output="$output"
 ) >"$log" 2>&1; then
   echo "authentication smoke: hermetic browser suite failed" >&2
   sanitize_failure_log
@@ -53,4 +54,4 @@ if rg -a -Fq -- "$sentinel" "$log" "$output"; then
   exit 1
 fi
 
-printf 'authentication smoke: hermetic OIDC/browser suite passed on Node %s\n' "$actual_node"
+printf 'authentication smoke: hermetic OIDC/F1 browser suite passed on Node %s\n' "$actual_node"

scripts/unified-deployment-smoke.sh

@@ -986,9 +986,30 @@ task13_core_id() {
 }
 
 task13_assert_maintenance_auth_isolation() {
+  local rendered
+  rendered="$TASK13_TMP/maintenance-auth-isolation.json"
+  if ! task13_compose config --format json >"$rendered" 2>>"$TASK13_LOG"; then
+    task13_log_failure "render workspace maintenance mount isolation"
+  fi
+  node - "$rendered" <<'NODE'
+const config = JSON.parse(require("node:fs").readFileSync(process.argv[2], "utf8"));
+const maintenance = config.services?.["workspace-maintenance"];
+if (!maintenance || !Array.isArray(maintenance.volumes)) process.exit(1);
+if (maintenance.volumes.some((mount) => mount?.target === "/run/thothii-auth" || mount?.target === "/data/auth")) {
+  process.exit(1);
+}
+NODE
+  task13_compose_logged "seed core authentication isolation sentinel" exec -T core sh -ceu \
+    ': > /data/auth/task13-maintenance-isolation-sentinel'
   task13_compose_logged "workspace maintenance auth isolation" \
     --profile workspace-maintenance run --rm --no-deps --entrypoint sh workspace-maintenance -ceu \
-    'test ! -e /run/thothii-auth && test ! -e /data/auth'
+    'test ! -e /run/thothii-auth
+     test -d /data/auth
+     test ! -e /data/auth/task13-maintenance-isolation-sentinel'
+  task13_compose_logged "verify core authentication isolation sentinel" exec -T core sh -ceu \
+    'test -f /data/auth/task13-maintenance-isolation-sentinel'
+  task13_compose_logged "remove core authentication isolation sentinel" exec -T core sh -ceu \
+    'rm -f /data/auth/task13-maintenance-isolation-sentinel'
 }
 
 task13_assert_local_auth_lifecycle() {