feat(simulation): qualify D-only stock rover smoke

tests/test_simulation_s0.py

@@ -37,6 +37,8 @@ def test_canonical_s0_profile_is_strict_and_safe() -> None:
     profile = load_s0_profile(PROFILE)
 
     assert profile.profile_id == "ai-worker-px4-gazebo-v1"
+    assert profile.target_host.wsl_distribution == "MissionCore-Sim"
+    assert profile.target_host.container_runtime == "none"
     assert profile.storage.windows_root.drive.upper() == "D:"
     assert profile.storage.wsl_root.as_posix() == "/mnt/d/NDC_MISSIONCORE"
     assert profile.clock.authority == "gazebo:/clock"
@@ -46,13 +48,23 @@ def test_canonical_s0_profile_is_strict_and_safe() -> None:
     assert profile.authority.actuator_authority is False
     assert profile.authority.navigation_or_safety_accepted is False
     assert profile.authority.direct_actuator_setpoints_allowed is False
-    assert profile.ros.domain_id == 42
+    assert profile.ros.domain_id == 0
+    assert "docker" not in profile.required_tools
     assert {item.identifier for item in profile.components} >= {
         "px4-autopilot",
         "px4-msgs",
         "gazebo",
         "nav2",
     }
+    components = {item.identifier: item for item in profile.components}
+    assert components["px4-gazebo-models"].resolved_commit == (
+        "b6127f4ec20de867e215fb5f78ae88b80f371909"
+    )
+    assert components["ros2"].qualification_state == "candidate"
+    assert components["gazebo"].qualification_state == "candidate"
+    micro_xrce = next(item for item in profile.ports if item.identifier == "micro-xrce-dds")
+    assert micro_xrce.host_scope == "loopback-only-netns"
+    assert micro_xrce.bind == "0.0.0.0"
     assert {item.identifier for item in profile.processes} == {
         "simulation-orchestrator",
         "gazebo-server",
@@ -100,6 +112,20 @@ def test_profile_rejects_duplicate_scoped_port(tmp_path: Path) -> None:
         load_s0_profile(_write_profile(tmp_path, document))
 
 
+def test_profile_rejects_wildcard_bind_outside_loopback_namespace(
+    tmp_path: Path,
+) -> None:
+    document = _profile_document()
+    ports = document["ports"]
+    assert isinstance(ports, list)
+    first = ports[0]
+    assert isinstance(first, dict)
+    first["host_scope"] = "worker-wsl"
+
+    with pytest.raises(S0ProfileError, match="wildcard bind requires loopback-only-netns"):
+        load_s0_profile(_write_profile(tmp_path, document))
+
+
 def test_doctor_never_claims_go_without_target_evidence(monkeypatch: pytest.MonkeyPatch) -> None:
     monkeypatch.setattr(
         "k1link.simulation.s0._target_host_match",