Add live HTTP smoke coverage for representative APIs

[codeforester]

Goal

Add deterministic live HTTP smoke coverage for base-demo's representative API launch commands so CI verifies the executable, bound port, declared health URL, response headers, and routing together.

Background

Current main at c07a516 passes ./tests/validate.sh. The focused tests also report 73.9% Go statement coverage, 82% Python API branch coverage, and 90% Python CLI branch coverage.

The existing API tests stop before the real listener boundary:

• Go uses httptest against newServeMux; main and http.ListenAndServe are not executed.
• Python calls the WSGI application directly; main, make_server, and serve_forever are not executed.
• Both Java suites call responseFor and statusFor; neither HttpServer, the private exchange handler, nor the run scripts are exercised over HTTP.
• The service-lifecycle BATS cases use dry runs or a synthetic sleeping process. The hosted workflow checks the real catalog while these optional services are stopped, so it does not verify any declared API health URL.

#272 intentionally covered negative in-process behavior and listed real network listeners as a non-goal. A live repository search found no separate issue for this remaining integration boundary.

Scope

• Add a bounded smoke harness that launches the Go, Python, Java Gradle, and Java Maven APIs through their supported executable or run-script path on isolated loopback ports.
• Poll readiness with an explicit timeout and print the captured service log when startup fails.
• For every service, request /healthz, /hello, /info, and an unknown path over HTTP.
• Assert status codes, JSON payloads, Content-Type, and that /info reports the selected PORT.
• Guarantee cleanup of every child process and temporary state on success, assertion failure, signal, and startup timeout.
• Run the harness from ./tests/validate.sh and in both supported hosted validation environments where the required toolchains are provisioned.

Acceptance Criteria

• Each representative API is started through the same launch path documented in services/catalog.json or its directly built equivalent.
• CI proves that each listener binds only to loopback and becomes reachable within a bounded timeout.
• /healthz, /hello, and /info return the expected status, JSON body, and JSON content type for all four APIs.
• /info reflects the per-test PORT, and an unknown route returns the expected 404 behavior.
• Failed startup reports the service log and exits nonzero without leaking a child process or occupying a port.
• Existing unit, negative-path, lifecycle, build, and full validation tests remain green.

Validation

./tests/live_api_smoke.sh
./tests/validate.sh

Non-Goals

• Starting Docker Compose databases or requiring Docker for the smoke harness.
• Replacing the fast in-process unit tests added by Cover negative paths across representative API services #272.
• Adding a repository-wide percentage ratchet across unrelated languages.
• Redesigning the representative API contract or service lifecycle command.

Project Fields

• Status: Ready
• Priority: P2
• Area: CI
• Initiative: Adoption Polish
• Size: M
• Milestone: v0.2.0

Agent Assignment

• Assignee: codeforester
• Agent-ready: Yes. The untested boundary, service matrix, cleanup requirements, and validation entrypoints are explicit.