Contract exerciser for ditto PR staging.
The open PR adds the full contract surface: two exposes (web + named api
subdomain), a committed env file, secrets: true, and setup/pre_teardown
hooks, plus an env-proof.txt endpoint so you can verify each env layer
live. Upload a secret for this repo in the ditto dashboard first (the
deploy fails loudly until you do).