Test the probe and the card

The probe tests use an injected fetch, so they cover the shapes that matter
without a network: a matching width, a mismatch, an HTTP error, an unreachable
host, a timeout, and the key being sent only when there is one.

The client tests evaluate the bundle the way the real module loader does —
inside `window.__ModuleLoader__.load` — with a fake `require` that answers
`react` and throws on anything else. That throw is the point: it is the check
that the card stays inside the platform's seed table, which is the constraint a
hand-written client half is most likely to break. The card is then rendered by
expanding its element tree, and its handlers are driven directly to prove that a
changed field reaches `set`, a cleared field reaches `unset`, a number field is
sent as a number, a list round-trips through comma-separated text, and a
read-only namespace disables everything.

The status test moves with the behaviour: status may now run a read-only
`--version`, so the assertion is that it executes nothing else.

test/plugin.test.js

@@ -422,10 +422,13 @@ test('a workspace-write session with stateDir inside the workspace proceeds', as
   assert.deepEqual(state.shellRequests[0].sandboxPolicy, { mode: 'workspace-write', workspaceRoot: workspace })
 })
 
-test('configure and status never touch the shell, so they work under any sandbox', async () => {
+test('configure never touches the shell, and status only runs a read-only version check', async () => {
   const { state } = harness({}, { sandboxMode: 'workspace-write' })
   const tool = state.tools.get('slopo')
-  await tool.execute({ action: 'status' }, execContext('/some/workspace'))
   await tool.execute({ action: 'configure', config: { embeddingModel: 'x' } }, execContext('/some/workspace'))
-  assert.deepEqual(state.shellRequests, [])
+  assert.deepEqual(state.shellRequests, [], 'configure must not execute anything')
+  await tool.execute({ action: 'status' }, execContext('/some/workspace'))
+  for (const request of state.shellRequests) {
+    assert.match(request.command, /--version/, 'status may only run a read-only version check')
+  }
 })