Phase2 dry-run: pending A, probe, build-config client, gated task/add

Still default dry-run; ALLOW_LIVE_SUBMIT=0. Live gates closed.

scripts/probe_readonly.py

@@ -0,0 +1,17 @@
+#!/usr/bin/env python3
+"""Run only the task/page GET; print credential-free summary."""
+import json
+import sys
+from pathlib import Path
+sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
+from src.readonly_probe import probe_readonly
+
+
+def main():
+    result = probe_readonly()
+    print(json.dumps(result, ensure_ascii=False))
+    return 0 if result['auth_ok'] else 1
+
+
+if __name__ == '__main__':
+    sys.exit(main())