fix(smoke): keep prose out of the single-quoted exec_test body

The agent-browser execution guard added on 2026-09-07 carried its explanation
INSIDE the single-quoted script body, and the explanation contained an
apostrophe ("the fleet\'s only recurring amd64 runtime proof"). Inside '...'
bash treats a backslash as literal, so \' does not escape the quote -- it CLOSES
the string. The body truncated at that point and the remaining lines were parsed
by the calling shell.

Consequences, both measured rather than inferred:
  - exec_test received 12 arguments instead of 2 (verified two-sided: the fixed
    tree yields argc=2, HEAD yields argc=12).
  - the leaked `v=$(agent-browser --version)` ran on the CI RUNNER instead of
    inside the image. The runner has no agent-browser, so smoke and
    smoke-studio both failed with "line 770: command not found" after
    build-base had already spent ~46 minutes. Every downstream job was skipped.
  - the truncated body still passed inside the container and printed its green
    tick first, so the log shows a PASS immediately followed by the failure --
    the tick was real, it just no longer covered the assertion.

The prose now sits above the exec_test call, where an apostrophe cannot
terminate anything, and a comment at that spot records why it must stay there.

Not a new failure class: shellcheck flagged it as SC2289 at severity error the
same day, so the lint job has been red since run 186 (2026-09-07 21:21) and was
not read. The gate did its job; nobody looked.

scripts/smoke-test.sh

@@ -751,22 +751,30 @@ exec_test "pi-atelier registered from /opt, not npm: (volume-shadowing guard)" \
 # shadows it. The check that actually bites lives in
 # recreate-sanity-check.sh, which runs where the volume is real — that is
 # where a 7-week-old 0.27.0 was caught shadowing 0.35.2 on 2026-09-06.
+# EXECUTION is ASSERTED here, not printed. Until 2026-09-07 the version was
+# captured inside an echo with 2>/dev/null, so a binary that could not run at all
+# still PASSED and simply printed version=[] -- the same failure class as the bare
+# `node --version` two hundred lines up: a value displayed rather than compared.
+#
+# Why this exit code matters more than most: smoke runs `platforms: linux/amd64`
+# on an x86 runner, i.e. NATIVE amd64, so this is the fleet's only recurring
+# amd64 runtime proof for the linux-x64 ELF. No devbox can supply one -- every
+# machine in the pi fleet is an Apple Silicon Mac (mbp-m1-2020; tor-ms22 = Mac
+# Studio Mac13,1 M1 Max, verified 2026-08-17 by system_profiler; emb-7kj4vr4g =
+# Apple Silicon, 4 routes 2026-09-07). Asking a device for that proof is asking
+# for the impossible; CI already had it and was discarding it.
+#
+# KEEP PROSE OUT OF THE QUOTED BODY BELOW. On 2026-09-07 this explanation lived
+# INSIDE the single-quoted argument and contained an apostrophe ("the fleet's").
+# Inside '...' bash treats a backslash literally, so \' does not escape -- it
+# CLOSES the string. The body silently truncated, the remaining lines were parsed
+# by the RUNNER's shell instead of the container's, and `agent-browser --version`
+# ran on a host that has no agent-browser: "line 770: command not found", release
+# v1.8.14's smoke job failed after the base had already built. shellcheck caught
+# it as SC2289 the same day and the red lint job went unread for 24h.
 exec_test "agent-browser resolves under /usr (volume-shadowing guard, build-time half)" '
   p=$(command -v agent-browser) || { echo "agent-browser not on PATH" >&2; exit 1; }
   r=$(readlink -f "$p")
-  # EXECUTION is now ASSERTED, not printed. Until 2026-09-07 the version was
-  # captured inside an echo with 2>/dev/null, so a binary that could not run at
-  # all still PASSED this test and simply printed version=[]. Same failure class
-  # as the bare `node --version` two hundred lines up: a value displayed rather
-  # than compared.
-  # Why this particular exit code matters more than most: smoke runs
-  # `platforms: linux/amd64` on an x86 runner, i.e. NATIVE amd64, so this line is
-  # the fleet\'s only recurring amd64 runtime proof for the linux-x64 ELF. No
-  # devbox can ever supply one -- every machine in the pi fleet is an Apple
-  # Silicon Mac (mbp-m1-2020; tor-ms22 = Mac Studio Mac13,1 M1 Max, verified
-  # 2026-08-17 by system_profiler; emb-7kj4vr4g = Apple Silicon, 4 routes
-  # 2026-09-07). Asking a device for that proof is asking for the impossible;
-  # CI already had it and was discarding it.
   v=$(agent-browser --version) || { echo "agent-browser did not EXECUTE" >&2; exit 1; }
   test -n "$v" || { echo "agent-browser --version produced no output" >&2; exit 1; }
   echo "resolved=[$r] version=[$(printf %s "$v" | head -n1)]" >&2