fix(plane): apply a Task after the Workspaces it binds; end-to-end smoke Run

On the live cluster ax created the Task before its Workspace in the same apply
and the runner saw an empty AX_WORKSPACES_YAML. Tests now find rendered
documents by kind and name, not position. ops/ax/smoke-run.sh renders a
model-free repo-facts Run with the current runner digest and executes it
through the reconciler.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo

ops/ax/smoke-run.yaml.tmpl

@@ -0,0 +1,39 @@
+# End-to-end smoke of the plane on ax: `ousast plane run` submits one model-free repo-facts Task, resumes it,
+# starts it through Substrate's router and receives its artifacts on the host. Rendered by ops/ax/smoke-run.sh.
+apiVersion: ax.io/v1alpha1
+kind: Workspace
+metadata:
+  name: ousast-e2e-ws
+  atespace: default
+spec:
+  files:
+    - path: "app/views.py"
+      content: "from app.db import run_query\n\ndef handler(request):\n    return run_query(request.args['q'])\n"
+    - path: "app/db.py"
+      content: "def run_query(sql):\n    return cursor.execute(sql)\n"
+---
+apiVersion: ax.io/v1alpha1
+kind: Task
+metadata:
+  name: ousast-e2e-facts
+  atespace: default
+spec:
+  image: "${RUNNER_IMAGE}"
+  command: ["repo-facts"]
+  resources:
+    requests: {cpu: "250m", memory: "512Mi"}
+    limits: {cpu: "1", memory: "1Gi"}
+  workspaces:
+    - name: ousast-e2e-ws
+      path: "/workspace/case"
+---
+apiVersion: openultrasast.io/v1alpha1
+kind: Run
+metadata:
+  name: ax-e2e-smoke
+spec:
+  tasks:
+    - name: facts
+      task: ousast-e2e-facts
+      outputs: [facts.json, summary.json]
+      budget: {usd: 0, calls: 0}