fix(release): close fixed-code mobile auth gaps

scripts/tests/aug1-authenticated-production.test.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+SCRIPT="$ROOT/scripts/verify-aug1-authenticated-production.sh"
+
+contains() {
+  grep -Fq -- "$2" "$1" || {
+    echo "FAIL: expected '$2' in $1" >&2
+    exit 1
+  }
+}
+
+not_contains() {
+  if grep -Fq -- "$2" "$1"; then
+    echo "FAIL: forbidden '$2' in $1" >&2
+    exit 1
+  fi
+}
+
+contains "$SCRIPT" '[[ "${1:-}" != "--execute" ]]'
+contains "$SCRIPT" 'AIHR_SMS_PROD_FIXED_CODE_ENABLED'
+contains "$SCRIPT" "u.user_type = 'app_user'"
+contains "$SCRIPT" 'HAVING COUNT(DISTINCT o.ext_party_id) = 1'
+contains "$SCRIPT" 'FIXED_SMS_NO_REAL_SEND_LOG=PASS'
+contains "$SCRIPT" 'DIRECT_CHANNEL_COUNT'
+contains "$SCRIPT" 'LOGOUT_TOKEN_REJECTED'
+contains "$SCRIPT" 'time.sleep(60)'
+contains "$SCRIPT" 'RELOGIN_FIXED_SMS_REQUEST'
+contains "$SCRIPT" '"MOBILE_RELOGIN"'
+contains "$SCRIPT" 'MOBILE_RELOGIN_ME'
+contains "$SCRIPT" 'fixed_log_before + 2'
+not_contains "$SCRIPT" 'echo "$phone"'
+not_contains "$SCRIPT" 'echo "$fixed_code"'
+not_contains "$SCRIPT" 'echo "$token"'
+not_contains "$SCRIPT" '/api/aihr/direct/feedback",'
+not_contains "$SCRIPT" '/api/aihr/agent/messages",'
+not_contains "$SCRIPT" '/api/ai/asr",'
+not_contains "$SCRIPT" '/api/ai/tts",'
+
+echo "PASS: authenticated production smoke is fixed-code-only, redacted and non-business-writing"