test(e2e): address review feedback on dashboard reachability

Poll port-bound check (TC-DASH-01) since `openshell forward start
--background` forks and returns before the port is bound. Soften
body-marker check (TC-DASH-03) to WARN+pass on missing marker so
SPA shells don't trip the assertion while still hard-failing on
non-HTML responses. Remove dead TIMEOUT_CMD detection.

Signed-off-by: Evan Takahashi <evan10takahashi@gmail.com>

Author: evantakahashi

test/e2e/test-dashboard-reachability.sh

@@ -33,16 +33,6 @@ POLL_ATTEMPTS=30
 POLL_INTERVAL=1
 LOG_FILE="test-dashboard-reachability-$(date +%Y%m%d-%H%M%S).log"
 
-# macOS uses gtimeout (from coreutils); Linux uses timeout
-if command -v gtimeout &>/dev/null; then
-  TIMEOUT_CMD="gtimeout"
-elif command -v timeout &>/dev/null; then
-  TIMEOUT_CMD="timeout"
-else
-  echo "ERROR: Neither timeout nor gtimeout found. Install coreutils: brew install coreutils"
-  exit 1
-fi
-
 RED='\033[0;31m'
 GREEN='\033[0;32m'
 YELLOW='\033[1;33m'
@@ -171,7 +161,6 @@ preflight() {
   log "nemoclaw: $(nemoclaw --version 2>/dev/null || echo 'unknown')"
   log "openshell: $(openshell --version 2>&1 | head -1 || echo 'unknown')"
   log "dashboard port: $DASHBOARD_PORT"
-  log "timeout: $TIMEOUT_CMD"
 
   if [[ -f "$HOME/.nemoclaw/onboard.lock" ]]; then
     log "Removing stale onboard lock"
@@ -216,15 +205,24 @@ setup_sandbox() {
 # Confirms the port-forward exists before we try HTTP. Separating this from
 # the HTTP check gives a clearer failure signal: if the port is not bound at
 # all, it's a forward-layer problem, not a gateway-process problem.
+#
+# Polls because `openshell forward start --background` forks and returns
+# before the child has actually bound the port (see src/lib/onboard.ts,
+# ensureDashboardForward).
 test_dash_01_port_bound() {
   log "=== TC-DASH-01: Dashboard port bound on host ==="
 
-  if lsof -iTCP:"$DASHBOARD_PORT" -sTCP:LISTEN >/dev/null 2>&1; then
-    pass "TC-DASH-01: Port $DASHBOARD_PORT is bound"
-  else
-    fail "TC-DASH-01: Dashboard port bound" \
-      "Nothing listening on $DASHBOARD_PORT — port-forward not established"
-  fi
+  local i
+  for i in $(seq 1 "$POLL_ATTEMPTS"); do
+    if lsof -iTCP:"$DASHBOARD_PORT" -sTCP:LISTEN >/dev/null 2>&1; then
+      pass "TC-DASH-01: Port $DASHBOARD_PORT is bound (after ${i}s)"
+      return
+    fi
+    sleep "$POLL_INTERVAL"
+  done
+
+  fail "TC-DASH-01: Dashboard port bound" \
+    "Nothing listening on $DASHBOARD_PORT after ${POLL_ATTEMPTS}s — port-forward not established"
 }
 
 # ── TC-DASH-02: Dashboard returns HTTP 200 ──────────────────────────────────
@@ -251,9 +249,9 @@ test_dash_02_http_200() {
 }
 
 # ── TC-DASH-03: Response body signature ─────────────────────────────────────
-# Guards against an unrelated process binding the dashboard port. The real
-# OpenClaw dashboard is an HTML page identifying itself in the body; any
-# other service returning 200 would not match.
+# Guards against an unrelated process binding the dashboard port. The
+# structural HTML check is the fail gate; the marker check is soft because
+# the dashboard may be an SPA whose raw HTML has no visible branding.
 test_dash_03_body_signature() {
   log "=== TC-DASH-03: Response body signature ==="
 
@@ -265,19 +263,17 @@ test_dash_03_body_signature() {
     return
   fi
 
-  # Primary: looks like HTML.
   if ! echo "$body" | grep -qiE '<html|<!doctype'; then
     fail "TC-DASH-03: Body signature" \
       "Response is not HTML — something else is bound to $DASHBOARD_PORT"
     return
   fi
 
-  # Secondary: body or <title> contains an OpenClaw / Control UI marker.
   if echo "$body" | grep -qiE 'openclaw|control[- ]?ui|nemoclaw'; then
     pass "TC-DASH-03: Response body identifies as OpenClaw dashboard"
   else
-    fail "TC-DASH-03: Body signature" \
-      "HTML served but no OpenClaw/Control-UI marker in body"
+    log "  ${YELLOW}WARN${NC} No OpenClaw/Control-UI marker in HTML body (may be SPA shell)"
+    pass "TC-DASH-03: HTML served on $DASHBOARD_PORT"
   fi
 }