test(m9): Blue-trigger reactive live-repaint probe + fixtures (#53)

[ClodoCapeo]

M9 — prove a Blue trigger repaints a live scene on air

Closes the last M9 brick (Pulsar #53): the probe that proves
POST /api/v1/blueprints/{id}/trigger repaints the live scene — the
end-to-end proof of Blue ADR 001 §6 criterion 4. Built on the M8 authoring

• provenance pipeline (PR feat(m8): Canvas-authored multi-blueprint live probe + provenance (LSDP) #52).

What this proves

The chain trigger → Blue interprets → maps outputs → pushes the scoped leaf → Orion recompute → delta → Solar repaint, no reload (ADR Blue 001 §3.2.5),
demonstrated on captured pixels:

1. SETUP (m9_setup.py, derived from m8_setup.py) authors a scene whose
   frame background is bound to __inputs.blue.pulsar-m9-bg.colour,
   declared as an operator_input with default colour A (#1A9E57). Orion
   seeds A on boot and accepts Blue's later in-scope write (sceneAcceptsPath).
2. capture-A — pre-flight (reused M6/M8 non-blank core): the live Solar
   frame is non-blank AND its modal ≈ A → build/m9-before.png.
3. fire — POST /blue/api/v1/blueprints/{id}/trigger with the operator
   Bearer header (never a query string — ADR Blue 001 R6) and
   inputs={colour: B} (#C81E5A).
4. capture-B — poll the same browser_source until modal ≈ B within
   Orion's input→delta budget AND Manhattan(B,A) > 80 → build/m9-after.png.

SetCaptureSource is issued once, so the change is a live LSDP repaint, not
a reload. A 200 from /trigger alone does not pass — the pixels must move
(delivery is best-effort, ADR Blue 001 §3.2.6). A=(26,158,87) vs B=(200,30,90)
are 305 apart in RGB Manhattan, far past the modal tolerance (24) and the
repaint floor (80), so the assertion is noise-proof.

Fixture (checked-in, deterministic)

• scripts/fixtures/m9-blueprint-bg.json — Blue passthrough blueprint
  (event→output, single core.input colour); stdlib-only nodes → publishes
  on any deployed Blue; never compiled by Orion (runs in Blue's interpreter).
• scripts/fixtures/m9-scene.lsml.json — LSML 1.1 bundle, frame bind.background
  → the leaf, operator_inputs[].default = A. No Canvas schema change (the
  existing per-node bind; Solar's resolveProps applies any binding key).

Sensitive surface (→ Bastion clearance)

This PR exercises a new auth/network surface (ADR Blue 001 R1–R6): it fires
the operator-gated /trigger and the Blue→Orion service-token push reacts. The
operator JWT now also authorises /trigger and is added to the grep-assert
needle set. run-m9.ps1 fails the run if the operator JWT, the Twitch key, or a
JWT-shaped show-token leaks to stdout / the before+after PNGs / VOD. No secret is
committed; all credentials come from étage-1.

Validation done (not the real run)

• py -3 -m py_compile on both modules — green.
• Plumbing harness: bundle hash determinism; the scene's bound leaf == the
  leaf Blue's real leaf_mapper produces (__inputs.blue.pulsar-m9-bg.colour);
  A/B distance 305; /trigger issues POST with Authorization: Bearer
  header (asserted no token= in the URL), correct path + body.
• Orion validateBindingKeys: blueprint-free scene → the __inputs.* binding
  passes compile.
• run-m9.ps1 parses clean, no BOM.

The real run (spawn Pulsar CEF, broadcast/capture) is the separate final
validation step — left to Keeper/Probe.

Stacking

Stacked on #52 (M8): M9 reuses m8_setup.py + probe-m8-canvas-live.py +
probe-m6-live.py, none of which are on main yet. Base is set to
forge/pulsar-44-m8-canvas-live so this diff is M9-only. Merge #52 first,
then rebase/retarget this PR onto main.

Keeper run notes

• Provide M8_OPERATOR_TOKEN (étage-1 .env.m8, short-TTL admin JWT — drives
  SETUP and /trigger; must not equal ORION_OPERATOR_TOKEN), and a
  deployed Blue with the bridge on (BLUE_OPERATOR_TOKEN set so
  pushed.delivered=true; otherwise the frame stays at A and the probe fails by
  design). Run: pwsh scripts/run-m9.ps1 (add -Broadcast + TWITCH_STREAM_KEY
  for the optional 30s go-live).

Refs #53

🤖 Generated with Claude Code