refactor(workflow): simplify chroot smoke test prompt

Reduce the prompt to just verify language runtimes exist and print versions.
The agent doesn't need to know it's running inside awf/chroot - if the
runtimes work, the feature works.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: Mossaka

.github/workflows/smoke-chroot.lock.yml

@@ -46,25 +46,11 @@ safe-outputs:
 timeout-minutes: 20
 ---
 
-# Smoke Test: Chroot Feature Validation
+# Verify Language Runtimes
 
-**IMPORTANT: You are running inside awf with `--enable-chroot` enabled. Host binaries are available at their standard paths. Run commands directly - do NOT use `sudo awf` or any wrapper.**
+Check that common language runtimes are installed and print their versions.
 
-## Context
-
-The `--enable-chroot` feature allows you to transparently access host binaries (Python, Node, Go, Java, .NET) at their standard paths. You can run these directly without any special commands.
-
-The expected host versions are set up by the workflow:
-- Python: 3.12.x
-- Node.js: 24.x.x
-- Go: 1.23.x
-- Java: 21.x.x (Temurin)
-- .NET: 8.x.x
-
-## Test Tasks
-
-### 1. Language Runtime Version Tests
-Run each runtime and capture its version. These should match the host versions above.
+Run these commands and report the results:
 
 ```bash
 python3 --version
@@ -74,75 +60,4 @@ java --version 2>&1 | head -1
 dotnet --version
 ```
 
-### 2. Standard Library Tests
-Verify each runtime can access its standard libraries:
-
-```bash
-# Python stdlib
-python3 -c "import json, os, sys, http.client; print('Python stdlib OK')"
-
-# Node.js builtins
-node -e "require('fs'); require('path'); require('os'); console.log('Node builtins OK')"
-
-# Go compilation (needs init for modules)
-cd /tmp && rm -rf gotest && mkdir gotest && cd gotest && go mod init test && echo 'package main; func main() { println("Go OK") }' > main.go && go run main.go
-
-# .NET runtime check
-dotnet --list-runtimes
-```
-
-### 3. Security Boundary Tests
-Verify security restrictions are in place:
-
-```bash
-# Docker socket should NOT exist or be /dev/null
-ls -la /var/run/docker.sock 2>&1
-
-# iptables should fail (no NET_ADMIN capability)
-iptables -L 2>&1
-
-# /usr should be read-only
-touch /usr/testfile 2>&1
-
-# /tmp should be writable
-echo test > /tmp/awf-test && cat /tmp/awf-test && rm /tmp/awf-test
-```
-
-### 4. User Identity Test
-```bash
-whoami
-id
-```
-
-## Output Requirements
-
-Create a PR comment with a summary table. Keep it concise.
-
-| Test | Result |
-|------|--------|
-| Python version | [version] - PASS if 3.12.x |
-| Node.js version | [version] - PASS if 24.x |
-| Go version | [version] - PASS if 1.23.x |
-| Java version | [version] - PASS if 21.x |
-| .NET version | [version] - PASS if 8.x |
-| Python stdlib | PASS/FAIL |
-| Node builtins | PASS/FAIL |
-| Go compilation | PASS/FAIL |
-| .NET runtime | PASS/FAIL |
-| Docker socket hidden | PASS/FAIL |
-| iptables blocked | PASS/FAIL |
-| /usr read-only | PASS/FAIL |
-| /tmp writable | PASS/FAIL |
-| User not root | PASS/FAIL |
-
-If ALL tests pass, add the label `smoke-chroot`.
-
-## Expected Results
-
-- All runtimes should be accessible at standard paths with matching versions
-- Standard library tests should all pass
-- Docker socket should not exist or be mapped to /dev/null
-- iptables commands should fail with "Permission denied" or "Operation not permitted"
-- /usr should be read-only
-- /tmp should be writable
-- User should NOT be root (should be awfuser or similar)
+Add a comment to the PR with a table showing each runtime and its version. If all runtimes are found, add the label `smoke-chroot`.