fix(smoke): bound each bootstrap request and run the tests in CI

Both from Greptile on #12316.

The retry loop only checks its deadline between attempts, so an unbounded
curl that connects and then stalls never returns to be checked. That would
have run the job to its 45-minute timeout printing nothing — strictly worse
than the single-attempt failure this change set out to fix. Cap each request
with --max-time and --connect-timeout.

The repository enumerates its script-level node:test files one by one in
pr.yml, and the new suite was not among them, so six regression cases sat in
the tree without running. Add it.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.github/workflows/pr.yml

@@ -72,6 +72,9 @@ jobs:
       - name: Test standalone package build concurrency
         run: node --test ./scripts/__tests__/build-standalone-concurrency.test.mjs
 
+      - name: Test release smoke admin bootstrap
+        run: node --test ./scripts/__tests__/docker-onboard-smoke-bootstrap.test.mjs
+
       - name: Validate release package manifest
         run: node ./scripts/release-package-map.mjs check
 

scripts/__tests__/docker-onboard-smoke-bootstrap.test.mjs

@@ -140,6 +140,17 @@ test("gives up at the deadline rather than hanging", () => {
   assert.ok(r.elapsedMs < 30000, `overran the deadline: ${r.elapsedMs}ms`);
 });
 
+test("bounds every request so the deadline can actually be reached", () => {
+  // The retry loop only checks its deadline between attempts. An unbounded curl
+  // that connects and then stalls never returns to be checked, so the job would
+  // run to its own 45-minute timeout printing nothing — strictly worse than the
+  // single-attempt failure this change replaced. Asserted on the script text
+  // because the harness above stubs the helper out.
+  const helper = extractFunction("post_json_with_cookies");
+  assert.match(helper, /--max-time/, "post_json_with_cookies must cap request duration");
+  assert.match(helper, /--connect-timeout/, "post_json_with_cookies must cap connect time");
+});
+
 test("reports the HTTP status it saw, not just an empty body", () => {
   // The reason this flake went a week without a diagnosis: the failure printed
   // the response body, and a sign-up that never connected has none. The status

scripts/docker-onboard-smoke.sh

@@ -135,11 +135,19 @@ generate_bootstrap_invite_url() {
   printf '%s\n' "$invite_url"
 }
 
+# Seconds any single bootstrap request may take. Without this a connection that
+# is accepted and then stalls hangs curl forever: the retry loop below only
+# checks its deadline between attempts, so an unbounded call never returns to be
+# checked and the job runs to its own timeout printing nothing.
+SMOKE_REQUEST_TIMEOUT_SECONDS="${SMOKE_REQUEST_TIMEOUT_SECONDS:-20}"
+
 post_json_with_cookies() {
   local url="$1"
   local body="$2"
   local output_file="$3"
   curl -sS \
+    --connect-timeout 5 \
+    --max-time "$SMOKE_REQUEST_TIMEOUT_SECONDS" \
     -o "$output_file" \
     -w "%{http_code}" \
     -c "$COOKIE_JAR" \