Merge authoritative main into the task branch

Why: include the current integration baseline before verification.

Evidence: fetched origin/main=b008bd94ad0fe6f520a8500f40ed6297251762b7.

Impact: integrate upstream changes without rewriting task history.

Refs: task-sync

scripts/e2e.sh

@@ -78,6 +78,7 @@ cleanup() {
   [ -n "${UI_PID:-}" ] && kill "$UI_PID" 2>/dev/null || true
   pkill -f "vite preview --port $UI_PORT" 2>/dev/null || true
   pkill -f "agent-system-rdm -data.*e2e" 2>/dev/null || true
+  pkill -f "agent-system serve .*$API_PORT" 2>/dev/null || true
 }
 trap cleanup EXIT
 (cd "$RDM_WT" && go build -o "$OUT/agent-system-rdm" .) || die "rdm build failed"
@@ -220,4 +221,26 @@ set -e
 cat "$OUT/playwright.log"
 [ "$PW_EXIT" = 0 ] && log "PASS" || die "playwright exit=$PW_EXIT (log: $OUT/playwright.log, trace: $OUT/frontend/test-results/)"
 
+# ── 4. 普通基座缺能力场景（增量 2 验收）──────────────────
+# 同一 $DATA 换基座 CLI 服务（与 RDM 二进制同源同 pin，命令面无 rdm.inspect.*），
+# preview 不动只换 /api 指向，跑 plain-base spec：审计入口隐藏、代理常驻、
+# 全程无 rdm.* 命令请求——消除「入口可达、进入即 400」的原缺陷路径。
+log "plain-base phase: serve base CLI (no RDM commands)"
+stop_serve
+"$OUT/agent-system" serve --data "$DATA" --addr "127.0.0.1:$API_PORT" --auth on \
+  >"$OUT/serve-plain.log" 2>&1 &
+API_PID=$!
+for i in $(seq 1 40); do
+  CODE=$(curl -s -o /dev/null -w '%{http_code}' "$API_BASE/api/me" || echo 000)
+  [ "$CODE" != "000" ] && break
+  sleep 0.25
+  [ "$i" = 40 ] && { tail -5 "$OUT/serve-plain.log"; die "plain api not ready"; }
+done
+set +e
+E2E_PLAIN_BASE=1 npx playwright test e2e/plain-base.playwright.ts --reporter=list >"$OUT/playwright-plain.log" 2>&1
+PW_PLAIN_EXIT=$?
+set -e
+cat "$OUT/playwright-plain.log"
+[ "$PW_PLAIN_EXIT" = 0 ] && log "PASS (plain-base)" || die "plain-base playwright exit=$PW_PLAIN_EXIT (log: $OUT/playwright-plain.log)"
+
 log "done; artifacts in $OUT"