test(smoke): assert agent-browser EXECUTES — it was the discarded amd64 proof

Second instance of the same bug class as the node line, in the same file, found
the same way. The agent-browser guard captured the version inside an echo with
2>/dev/null:

  echo "resolved=[$r] version=[$(agent-browser --version 2>/dev/null|head -n1)]" >&2

so the exit code was discarded and a binary that could not execute at all still
PASSED, printing version=[]. Verified two-sided: a stub exiting 127 passes the old
form and is caught by the new one.

Why this exit code matters more than most: smoke runs platforms: linux/amd64 on an
x86 runner, i.e. NATIVE amd64, so this line is the fleet's only recurring amd64
runtime proof for agent-browser's linux-x64 ELF.

NO DEVBOX CAN EVER SUPPLY THAT PROOF. Every machine in the pi fleet is an Apple
Silicon Mac: mbp-m1-2020; tor-ms22 = Mac Studio Mac13,1 M1 Max (fleet-ops
hosts/tor-ms22.md, verified 2026-08-17 with system_profiler); emb-7kj4vr4g =
Apple Silicon, verified 4 routes 2026-09-07. The open "amd64 runtime proof still
needed" ask sent to two devices was asking for the impossible, and emb's reply
naming tor-ms22 as "the only remaining candidate" is wrong for the same reason.
CI had the answer all along and was throwing it away.

Dockerfile.base:607 DOES assert it (`agent-browser --version && \`), but only when
the base rebuilds, and v1.8.13's base was cached — so smoke is where the recurring
gate belongs.

scripts/smoke-test.sh

@@ -754,7 +754,22 @@ exec_test "pi-atelier registered from /opt, not npm: (volume-shadowing guard)" \
 exec_test "agent-browser resolves under /usr (volume-shadowing guard, build-time half)" '
   p=$(command -v agent-browser) || { echo "agent-browser not on PATH" >&2; exit 1; }
   r=$(readlink -f "$p")
-  echo "resolved=[$r] version=[$(agent-browser --version 2>/dev/null | head -n1)]" >&2
+  # EXECUTION is now ASSERTED, not printed. Until 2026-09-07 the version was
+  # captured inside an echo with 2>/dev/null, so a binary that could not run at
+  # all still PASSED this test and simply printed version=[]. Same failure class
+  # as the bare `node --version` two hundred lines up: a value displayed rather
+  # than compared.
+  # Why this particular exit code matters more than most: smoke runs
+  # `platforms: linux/amd64` on an x86 runner, i.e. NATIVE amd64, so this line is
+  # the fleet\'s only recurring amd64 runtime proof for the linux-x64 ELF. No
+  # devbox can ever supply one -- every machine in the pi fleet is an Apple
+  # Silicon Mac (mbp-m1-2020; tor-ms22 = Mac Studio Mac13,1 M1 Max, verified
+  # 2026-08-17 by system_profiler; emb-7kj4vr4g = Apple Silicon, 4 routes
+  # 2026-09-07). Asking a device for that proof is asking for the impossible;
+  # CI already had it and was discarding it.
+  v=$(agent-browser --version) || { echo "agent-browser did not EXECUTE" >&2; exit 1; }
+  test -n "$v" || { echo "agent-browser --version produced no output" >&2; exit 1; }
+  echo "resolved=[$r] version=[$(printf %s "$v" | head -n1)]" >&2
   case "$r" in /usr/*) ;; *) exit 1 ;; esac
   test ! -d "$HOME/.pi/npm-global/lib/node_modules/agent-browser" || exit 1
   echo ok