test: add workbench dom-only live validation

docs/reference/cloud-workbench.md

@@ -78,6 +78,7 @@ heavier browser run:
 node web/hwlab-cloud-web/scripts/check.mjs
 node web/hwlab-cloud-web/scripts/build.mjs
 node scripts/dev-cloud-workbench-smoke.mjs --static
+node scripts/dev-cloud-workbench-smoke.mjs --dom-only --url http://74.48.78.17:16666/
 ```
 
 The static smoke checks both sides of the route contract: `/` remains the
@@ -89,6 +90,13 @@ Live checks against `http://74.48.78.17:16666/` are read-only and must report
 blocked/skip instead of false green when the browser or network path is not
 available.
 
+`--dom-only` keeps the runtime and web-asset identity preflight checks, then
+continues with read-only DOM/help validation for the deployed workbench even
+when identity drift blocks the full journey. It never sends `POST
+/v1/agent/chat`; the Code Agent journey is recorded as `not_applicable` and
+must not be used as a DEV-LIVE reply, Secret, mutation, or M3/M4/M5 acceptance
+claim.
+
 ## Stable Sources
 
 - [pikasTech/HWLAB#99](https://github.com/pikasTech/HWLAB/issues/99): default