test(phase6e): acceptance suite, real-Lab rehearsal, and regression fixes for the lock fix

Adds platform/test/e2e-phase6e.js (23 checks): full ROOT 02/03/04 hierarchy/content/assessment-
pool verification, the complete ROOT 01->02->03->04->05 chain proven on one student (each
course's completion unlocking exactly the next), the direct-API lock bypass proven blocked on
both a Phase 6E course pair and a pre-existing unrelated pair, existing ROOT 06+/Capstone/
is_required behavior confirmed unaffected, self-paced no-instructor-deferral scan,
instructor-notes exclusion, RBAC, persistence, isolation, version stability, content validation.
23/23 pass against both a warm and a freshly-reset stack.

Adds platform/test/foundations-helper.js — a shared completeRootFoundations01Through04/
completeThroughRoot06/completeThroughRoot10 helper, extracted once multiple suites needed the
identical real-completion sequence as test setup, rather than duplicating it four times.

Adds infra/scripts/drills/{run,test}-phase6e-foundations-rehearsal — the real Platform API/
Gateway/Provisioner/disposable-Lab/nested-Docker/Git/k3s dress rehearsal: one real Lab task per
new course (nginx inspection, a real merge conflict, a real container-networking fix) plus the
full chain to a genuine ROOT 05 unlock, with k3s reconfirmed healthy and untouched at the end.
13/13 pass against a real, freshly-built stack.

Fixes the regression fallout from the (correct) course-routes.js lock fix: several earlier
suites' own historical shortcuts had accumulated small ordering/scenario gaps the missing
enforcement had been silently covering for — none were platform bugs. e2e-phase6a/6b/6c/6d.js
now inject the real ROOT 01-04 (and where needed ROOT 05/06/10) completion sequence via
foundations-helper.js before touching ROOT 05+ content; e2e-phase6b.js's bypass-student flow now
completes deployment-rollback/job-task/cronjob-task/container-logging-mcq explicitly (real
scenarios added in later phases that its original ALL_STAGES list never included); e2e-phase6a/
6d.js's own ROOT 01/05 completion tests now complete each module fully (through its lab and
reflection) before moving to the next, since those courses' own modules carry real intra-course
prerequisites. Two now-obsolete Phase-6D-era assertions in e2e-phase6d.js (ROOT 02-04 stay
PLANNED / stay vacuously unlocked) are updated to assert the opposite, with a comment explaining
Phase 6E intentionally changed that fact. All four suites re-verified green fresh.

Also fixes a real, reproducible dash-vs-bash bug caught while testing the new ROOT 01
rehearsal's ordering fix: `&>file` misparses under this image's actual /bin/sh (dash), breaking
a later `$!`-based kill — the rehearsal script now writes multi-line completion loops with
explicit status assertions, matching the discipline the other suites already use.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

platform/test/e2e-phase6a.js

@@ -17,6 +17,7 @@
 const assert = require('assert');
 const { execSync } = require('child_process');
 const { makeSession } = require('./session-helper');
+const { completeRootFoundations01Through04 } = require('./foundations-helper');
 
 const GW = process.env.GATEWAY_URL || 'http://localhost:4200';
 const API = process.env.PLATFORM_API_URL || 'http://localhost:4300';
@@ -38,6 +39,14 @@ const FOUNDATION = ['pod-basics-mcq', 'kubectl-essentials-mcq', 'labels-selector
 const WORKLOADS = ['deploy-nginx', 'scale-deployment', 'rolling-update-task', 'liveness-probe-task', 'jobs-cronjobs-mcq', 'daemonset-mcq', 'edit-deployment-basics', 'deployment-strategy-mcq'];
 const NETWORKING = ['services-mcq', 'expose-service-basics'];
 const CONFIGURATION = ['configmap-volume', 'resource-limits-task', 'env-vars-configmap', 'secrets-basics', 'pod-env-vars-inline'];
+
+// Phase 6E added real content to ROOT 01-04, and root-05's own prerequisite (root-04) is no
+// longer vacuously satisfied — this suite's ROOT 05 content is now genuinely locked behind the
+// real foundations sequence for any student who hasn't completed it, exactly the enforcement
+// docs/PHASE6E_ROOT_FOUNDATIONS_COMPLETION.md's course-routes.js fix now guarantees even via
+// direct API. completeRootFoundations01Through04 (foundations-helper.js) does this quickly as
+// test setup, not this file's own subject — see e2e-phase6e.js for the real ROOT 01-04
+// acceptance coverage.
 const TROUBLESHOOTING = ['extract-logs-basics', 'kubectl-cp-basics', 'exec-command-basics', 'node-cordon-basics', 'pod-node-assignment-mcq'];
 const REAL_OPS = ['rootnode-runaway-monitor', 'broken-deployment', 'rootnode-probe-port-mismatch', 'rootnode-enforce-limits'];
 
@@ -122,7 +131,7 @@ async function main() {
     assert.equal(status, 200);
     tree = body.courses;
     const root05 = courseById(tree, 'root-05-kubernetes-foundations');
-    assert.equal(root05.locked, false); // root-04 (its real Phase 6D prerequisite) has zero activities — vacuously satisfied
+    assert.equal(root05.locked, true, 'Phase 6E gave root-04 (root-05\'s real prerequisite) real content — root-05 is now genuinely gated, not vacuously satisfied');
     assert.equal(root05.complete, false);
     const root06 = courseById(tree, 'root-06-kubernetes-application-workloads');
     assert.equal(root06.locked, true, 'root-06 must be locked until root-05 is complete');
@@ -146,6 +155,12 @@ async function main() {
     assert.equal(body.error, 'not_manually_completable');
   });
 
+  await test('completing the real ROOT 01-04 foundations sequence unlocks ROOT 05 (Phase 6E test setup, not this file\'s own subject)', async () => {
+    await completeRootFoundations01Through04(casey);
+    const { body } = await casey.request('GET', `/api/student/programs/${enrollmentId}/courses`);
+    assert.equal(courseById(body.courses, 'root-05-kubernetes-foundations').locked, false);
+  });
+
   await test('completing root-05\'s 20 real scenarios + the Phase 6B mental-model module marks the course complete and unlocks root-06', async () => {
     for (const sid of FOUNDATION) await completeScenario(casey, sid);
     // Phase 6B's root-05-m00 has its own manual-marker activities (lesson/demonstration/
@@ -170,6 +185,25 @@ async function main() {
     assert.equal(root06.locked, false, 'root-06 must unlock once root-05 is complete');
   });
 
+  await test('completing root-06 fully unlocks root-10 (its real course-level prerequisite, now enforced even via direct API)', async () => {
+    for (const sid of WORKLOADS) await completeScenario(casey, sid);
+    for (const suffix of ['a01-lesson-deployments', 'a02-demonstration-rollout', 'a03-knowledge-check', 'a04-guided-exercise-rollout-strategy']) {
+      await casey.request('POST', `/api/student/activities/root-06-m02-${suffix}/complete`);
+    }
+    await completeScenario(casey, 'rolling-update-task');
+    await completeScenario(casey, 'deployment-rollback');
+    await casey.request('POST', '/api/student/activities/root-06-m02-a06-reflection/complete');
+    for (const suffix of ['a01-lesson-jobs-cronjobs-daemonsets', 'a01b-demonstration-job-lifecycle', 'a02-knowledge-check', 'a02b-guided-exercise-choosing-primitive']) {
+      await casey.request('POST', `/api/student/activities/root-06-m03-${suffix}/complete`);
+    }
+    await completeScenario(casey, 'job-task');
+    await completeScenario(casey, 'cronjob-task');
+    await casey.request('POST', '/api/student/activities/root-06-m03-a05-reflection/complete');
+    const { body } = await casey.request('GET', `/api/student/programs/${enrollmentId}/courses`);
+    assert.equal(courseById(body.courses, 'root-06-kubernetes-application-workloads').complete, true);
+    assert.equal(courseById(body.courses, 'root-10-kubernetes-troubleshooting-observability').locked, false);
+  });
+
   // ── The gold module: lesson/demo/knowledge-check/guided-exercise (manual) + lab (auto) + reflection (manual) ──
   await test('lesson-only activities complete via the explicit marker, not automatically', async () => {
     for (const suffix of ['a01-lesson-health-check-concepts', 'a02-demonstration-probes-in-action', 'a03-knowledge-check', 'a04-guided-exercise-readiness-probe']) {