docs(stage5a): live demo first, everything else one command

[hanwencheng]

Summary

Restructures the Stage 5a manual-test guide around its two things that actually matter:

1. The live demo (real OpenRouter signup) — moved up top, expanded, clearly marked as the centerpiece. Still blocked on the ToS-check TODO.
2. Everything else — collapsed into a single bash harness/stage-5a-done.sh invocation. No more per-section prose for hermetic tests, CLI, MCP, and metrics.

The doc drops 494 lines and gains 186, net -308. The guide now reads: scope → demo → one-command gate → troubleshooting → 5b forecast → 2-item checklist.

Changes

• harness/stage-5a-done.sh — grew from 21 → 93 lines to cover every non-live check:

  1. Rust unit tests (4 crates)
  2. TS install + npm test
  3. Phantom-key chaos in isolation
  4. Pattern grep guard
  5. TS typecheck (new)
  6. Clippy on Stage 5a crates with -D warnings (new; --no-deps so pre-existing lints in agentkeys-core/agentkeys-mock-server don't fail the gate)
  7. MCP tools/list asserts agentkeys.provision registered (new)
  8. Observability — asserts the three core provision_metric names are emitted (new)

  Colored banners + ✓/✗ per step; final STAGE 5a PASSED on green, first failure aborts with a clear red marker.

• docs/manual-test-stage5.md — rewritten:

  • § 1 — The demo. Lead section. Prereqs, expected output, failure modes. DO NOT RUN YET banner unchanged.
  • § 2 — Everything else — one command. Single bash harness/stage-5a-done.sh invocation, with a table explaining what each of the 8 steps asserts.
  • § 3 — Troubleshooting, trimmed to the items that still apply in the script-driven flow.
  • § 4 — Stage 5b forecast — unchanged.
  • § 5 — Summary checklist — 2 items: script green, demo end-to-end (once ToS clears).

Test plan

• bash harness/stage-5a-done.sh → STAGE 5a PASSED (exit 0, all 8 steps green). Smoke-ran twice.
• bash -n harness/stage-5a-done.sh clean (syntax).
• Clippy with --no-deps confirmed to pass on Stage 5a crates even though agentkeys-core has a pre-existing ptr_arg warning (out of scope).
• MCP tools/list subprocess returns a response containing "name":"agentkeys.provision".
• Observability grep finds tier_used, duration_seconds, verification_result in the stores_credential test's --nocapture output.

No code changes outside the test harness + the doc. The live demo path is unchanged and remains the follow-up once the OpenRouter ToS check clears.

🤖 Generated with Claude Code

[hanwencheng]

Superseded by the new PR on docs/stage6-aws-setup. The harness/stage-5a-done.sh refactor from this PR is byte-identical to what landed on main via #48 and is already on the new branch. The docs/manual-test-stage5.md scope has been absorbed and further evolved on the new branch (plus-addressing demo path, Stage 5b + Stage 6 migration notes, backend selector docs).