fix(plane): apply a Task after the Workspaces it binds; end-to-end smoke Run

On the live cluster ax created the Task before its Workspace in the same apply
and the runner saw an empty AX_WORKSPACES_YAML. Tests now find rendered
documents by kind and name, not position. ops/ax/smoke-run.sh renders a
model-free repo-facts Run with the current runner digest and executes it
through the reconciler.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo

ops/ax/smoke-run.sh

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+# Render the end-to-end smoke Run with the current runner digest and execute it through the reconciler on ax.
+set -euo pipefail
+export PATH="$HOME/go/bin:$HOME/.local/bin:$PATH"
+SRC="${OUSAST_AX_SRC:-$HOME/.cache/ousast/ax-src}"
+RUNNER_IMAGE="$(cat "$SRC/runner-image")"; export RUNNER_IMAGE
+KIND_GW="$(docker network inspect kind --format '{{range .IPAM.Config}}{{if .Gateway}}{{.Gateway}} {{end}}{{end}}' | tr ' ' '\n' | grep -m1 '\.')"
+export OUSAST_ARTIFACT_HOST="${OUSAST_ARTIFACT_HOST:-$KIND_GW}"   # sandboxes reach the host via the kind gateway
+envsubst < "$(dirname "$0")/smoke-run.yaml.tmpl" > "$SRC/smoke-run.yaml"
+REPO="$(cd "$(dirname "$0")/../.." && pwd)"
+"$REPO/.venv/bin/ousast" plane run "$SRC/smoke-run.yaml" "$@"
+"$REPO/.venv/bin/ousast" plane status ax-e2e-smoke

ops/ax/smoke-run.yaml.tmpl

@@ -0,0 +1,39 @@
+# End-to-end smoke of the plane on ax: `ousast plane run` submits one model-free repo-facts Task, resumes it,
+# starts it through Substrate's router and receives its artifacts on the host. Rendered by ops/ax/smoke-run.sh.
+apiVersion: ax.io/v1alpha1
+kind: Workspace
+metadata:
+  name: ousast-e2e-ws
+  atespace: default
+spec:
+  files:
+    - path: "app/views.py"
+      content: "from app.db import run_query\n\ndef handler(request):\n    return run_query(request.args['q'])\n"
+    - path: "app/db.py"
+      content: "def run_query(sql):\n    return cursor.execute(sql)\n"
+---
+apiVersion: ax.io/v1alpha1
+kind: Task
+metadata:
+  name: ousast-e2e-facts
+  atespace: default
+spec:
+  image: "${RUNNER_IMAGE}"
+  command: ["repo-facts"]
+  resources:
+    requests: {cpu: "250m", memory: "512Mi"}
+    limits: {cpu: "1", memory: "1Gi"}
+  workspaces:
+    - name: ousast-e2e-ws
+      path: "/workspace/case"
+---
+apiVersion: openultrasast.io/v1alpha1
+kind: Run
+metadata:
+  name: ax-e2e-smoke
+spec:
+  tasks:
+    - name: facts
+      task: ousast-e2e-facts
+      outputs: [facts.json, summary.json]
+      budget: {usd: 0, calls: 0}