test: add workbench dom-only live validation

docs/reference/cloud-workbench.md

@@ -78,6 +78,7 @@ heavier browser run:
 node web/hwlab-cloud-web/scripts/check.mjs
 node web/hwlab-cloud-web/scripts/build.mjs
 node scripts/dev-cloud-workbench-smoke.mjs --static
+node scripts/dev-cloud-workbench-smoke.mjs --dom-only --url http://74.48.78.17:16666/
 ```
 
 The static smoke checks both sides of the route contract: `/` remains the
@@ -89,6 +90,13 @@ Live checks against `http://74.48.78.17:16666/` are read-only and must report
 blocked/skip instead of false green when the browser or network path is not
 available.
 
+`--dom-only` keeps the runtime and web-asset identity preflight checks, then
+continues with read-only DOM/help validation for the deployed workbench even
+when identity drift blocks the full journey. It never sends `POST
+/v1/agent/chat`; the Code Agent journey is recorded as `not_applicable` and
+must not be used as a DEV-LIVE reply, Secret, mutation, or M3/M4/M5 acceptance
+claim.
+
 ## Stable Sources
 
 - [pikasTech/HWLAB#99](https://github.com/pikasTech/HWLAB/issues/99): default

docs/reference/code-agent-chat-readiness.md

@@ -60,10 +60,13 @@ Workbench 静态接线检查：
 
 ```sh
 node scripts/dev-cloud-workbench-smoke.mjs --static
+node scripts/dev-cloud-workbench-smoke.mjs --dom-only --url http://74.48.78.17:16666/
 ```
 
 该命令验证 Workbench 默认页、同源只读边界和 `/v1/agent/chat` 前端主流程接线。它只产出
-`SOURCE` 级证据。
+`SOURCE` 级证据。`--dom-only` 会保留部署 runtime/web-asset identity preflight，
+但只做真实 DEV DOM/help 只读观察；它不会发送 `/v1/agent/chat`，Code Agent journey
+必须记录为 `not_applicable`，不能冒充真实 DEV-LIVE reply。
 
 授权凭证注入后的真实 DEV 复测：