ci(deploy): smoke accepts 403 (SDK v6 invalid-bearer status) (#3882)

First run of #3879's gate tripped on every per-tenant URL: SDK v6 returns
403 Forbidden for an invalid bearer where v5 returned 401. The smoke
only accepted 200|401, so a misconfigured `secrets.PUBLIC_TEST_AGENT_TOKEN`
false-failed the deploy even though all 7 tenants were healthy (verified
out-of-band with the documented public token: 200 + correct tool count
on every path).

200, 401, and 403 all prove the same thing — registry resolved, MCP
route alive. The bug modes this gate protects against (404 / 5xx) are
pre-auth and unaffected.

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: bokelley

.changeset/deploy-smoke-accept-403.md

@@ -0,0 +1,6 @@
+---
+---
+
+Hotfix for the deploy-smoke gate added in #3879. The first deploy that ran it tripped on every per-tenant URL: SDK v6's auth middleware returns `403 Forbidden` for an invalid bearer token (the gate's secret was misconfigured), where v5 returned `401 Unauthorized`. The smoke only accepted `200|401`, so all six per-tenant URLs failed and the deploy went red even though every tenant was healthy (verified out-of-band: 7/7 paths returned 200 with their expected tool counts using the documented public token).
+
+Accepts `403` alongside `200` and `401`. All three mean "registry resolved, MCP route alive" — which is what this smoke is checking. The bug modes it protects against (`404 Tenant not registered`, `5xx` registry init failure) happen before auth and are unaffected.

.github/workflows/deploy.yml

@@ -106,7 +106,9 @@ jobs:
           )
           # Build curl args once. Omit the Authorization header when the secret
           # is unset so a strict-bearer-format server can't 400 us into a false
-          # deploy failure — we accept 401 as healthy anyway.
+          # deploy failure — we accept 401/403 as healthy anyway. (SDK v5 used
+          # 401 for invalid bearer; v6 uses 403. Both mean the registry resolved
+          # and the MCP route is alive, which is what this smoke is checking.)
           auth_args=()
           if [ -n "${PUBLIC_TEST_AGENT_TOKEN:-}" ]; then
             auth_args=(-H "Authorization: Bearer ${PUBLIC_TEST_AGENT_TOKEN}")
@@ -131,7 +133,7 @@ jobs:
             url="${base}${path}"
             code=$(probe "${url}")
             case "${code}" in
-              200|401)
+              200|401|403)
                 echo "✅ ${path} → ${code}"
                 continue
                 ;;
@@ -140,7 +142,7 @@ jobs:
             sleep 8
             code=$(probe "${url}")
             case "${code}" in
-              200|401)
+              200|401|403)
                 echo "✅ ${path} → ${code} (after retry)"
                 ;;
               *)