- Replace openssh-client with ssh (checkable binary name)
- Remove socat (not a claude-dev container dependency)
- Handle ca-certificates as special package check in smoke-tools.sh
- Add SPECIAL_CHECKS array for packages without matching binaries
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Define claude-dev capabilities as a tested contract and deploy immutable tags only after smoke checks so daily tooling upgrades remain CI-first and rollback-safe.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>