Merge PR #400.\n\nValidated with node --test internal/cloud/server.test.mjs internal/cloud/code-agent-session-registry.test.mjs, node scripts/code-agent-chat-smoke.mjs, node web/hwlab-cloud-web/scripts/check.mjs, and npm run check. No DEV deploy apply or rollout performed.
Adds the Code Agent -> Skill CLI -> HWLAB API /v1/m3/io controlled M3 IO path with route/audit/evidence/blocker payloads and tests proving no direct gateway/box/patch-panel or OpenAI fallback hardware control.
Host commander review: merged PR #171 after diff review. Scope is user-visible Code Agent completion evidence and smoke guards that reject echo/mock/stub completions; live smoke is read-only aside from the minimal chat request and does not print reply text or secrets. No runtime mutation, no service restart, and no M3/M4/M5 acceptance claim.