Integration tests, each named for the decision it defends

Reviewed and the criticism was right: 1,072 of 2,128 lines untested, all of
it the half that touches the hypervisor, and no gate. The verification I had
done was real — pings across NAT, TTL counts, ruleset comparisons — and none
of it survived the terminal it ran in, which is 04-ISSUES/005 in miniature.

Ten integration tests against a real hypervisor, each named for what it
defends. ADR 0031: a raised machine carries no overlay, no wireguard, no
mesh config — a scenario that pre-built peering would certify its own work.
ADR 0032: exec is the only way in. ADR 0033: routers are containers while
machines are virtual machines. And the design's claims: raise waits for
usable, snapshots are whole-scenario, NAT hides a private address,
published reaches the machine at the gateway's address.

Mocking the hypervisor is forbidden, so they skip with a reason on a
machine that cannot raise scenarios rather than passing green having
checked nothing.

The suite earned itself on its first run. It found that a snapshot of a
running machine could miss a file written seconds earlier — not stale,
absent — because the write was still in the guest's page cache. That is
exactly the question the lifecycle design listed as open: does a scenario
snapshot need the machines stopped? It does not, but it does need them
flushed. snapshot now syncs every machine before capturing, and the design
records the answer.

The fix buys write-durability, not application-consistency: anything
mid-transaction is still captured mid-transaction, and that is now stated
rather than assumed.

npm run check is the gate — typecheck, 40 unit tests, 10 integration tests.

README.md

@@ -190,6 +190,31 @@ npm test          the declaration layer, offline
 npm run typecheck
 ```
 
-The lifecycle is not unit-tested. It talks to a hypervisor, and a fake one would assert that
-the fake behaves as expected — which is the shape of test this project exists to stop
-shipping. It is exercised by raising real scenarios.
+```
+npm test               the declaration layer, offline, 40 tests
+npm run test:integration   real scenarios against a real hypervisor, 10 tests
+npm run check          typecheck + both — this is the gate
+```
+
+**A test names the decision it defends** (`novox/hq` ADR 0034). A decision with no test is one
+that will quietly stop being true, and nobody learns that from a document:
+
+| Test | Defends |
+|---|---|
+| the lab provides the underlay and nothing of the overlay | ADR 0031 |
+| the workstation has no route into the scenario | ADR 0032 |
+| a router is a container while machines are virtual machines | ADR 0033 |
+| raise waits for *usable*, not for the call to return | the lifecycle design |
+| snapshots are whole-scenario | the lifecycle design |
+| a public range that is not documentation space is refused | the declaration design |
+| a scenario declaring what cannot be materialised is refused | the declaration design |
+
+**Mocking the hypervisor is forbidden.** A fake would assert that the fake behaves as expected,
+which is the shape of test this project exists to stop shipping. Integration tests skip with a
+reason on a machine that cannot raise scenarios, rather than passing green having checked
+nothing.
+
+That suite earned itself on its first run: it found that a snapshot of a running machine could
+miss a file written seconds earlier — not stale, **absent** — because the write was still in
+the guest's page cache. The design had listed that as an open question. The test answered it,
+and `snapshot` now flushes first.