feat(simulation): qualify D-only stock rover smoke

docs/runbooks/SIM_S0_AI_WORKER.md

@@ -5,11 +5,17 @@ real vehicle control or a `GO` verdict by itself.
 
 ## Safety and placement
 
-- Target: reviewed Windows 11 worker with WSL2 Ubuntu 24.04.
+- Target: reviewed Windows 11 worker with the dedicated `MissionCore-Sim` WSL2
+  Ubuntu 24.04 distribution physically installed on D.
 - All mutable bytes must be under `D:\NDC_MISSIONCORE`.
-- Do not place a WSL distribution, Docker VHD, source, build, cache, log, bag,
-  ULog, Gazebo artifact or dataset on C.
+- Do not place a WSL distribution, source, build, cache, log, bag, ULog,
+  Gazebo artifact or dataset on C.
+- Do not use or reconfigure the existing Docker Desktop runtime in S0. Its
+  backend is C-backed and serves unrelated co-tenants.
 - Do not expose S0 services beyond loopback.
+- Run providers inside the ephemeral loopback-only network namespace created
+  by `simulation/s0/worker-smoke.sh`. Micro XRCE-DDS Agent binds UDP wildcard
+  inside that namespace because v2.4.3 has no address-selection option.
 - Do not download full external datasets.
 - Keep `actuator_authority=false`.
 
@@ -24,13 +30,34 @@ uv run missioncore-sim s0 doctor --json
 
 Before target evidence exists, the expected verdict is `INCOMPLETE`.
 
+## Stock-rover smoke
+
+Copy the reviewed script to the D-only worker source root, then invoke it as
+root inside `MissionCore-Sim` with a unique immutable run ID:
+
+```bash
+simulation/s0/worker-smoke.sh <UTC-run-id>-stock-rover
+```
+
+The script:
+
+- creates a new network namespace containing only loopback;
+- starts Micro XRCE-DDS Agent, PX4 SITL and the stock Gazebo Ackermann world;
+- verifies the DDS session, `/fmu/out/vehicle_status_v1` and Gazebo `/clock`;
+- records listeners and a non-acceptance resource point sample;
+- sends the PX4 `shutdown` command and rejects owned-process residue.
+
+Do not reuse a run ID. A failed run remains diagnostic evidence; rerun with a
+new ID after correction.
+
 ## Required target inventory
 
 Record a redacted artifact for each of:
 
 1. Windows release, WSL version, Ubuntu version and architecture.
 2. GPU/driver, CPU, RAM and VRAM.
-3. Physical locations of the WSL distribution and Docker data/VHD.
+3. Physical location of the dedicated WSL distribution and confirmation that
+   the Docker-free S0 profile is active.
 4. D total/free bytes before installation.
 5. Existing Docker images, WSL distributions and simulation-related processes.
 6. Existing listeners and the candidate port registry.