test(worker): add opt-in real-claude smoke test

Spawns the actual claude binary and asserts exit code 0, a session id,
non-empty result, and output tokens > 0 (plan-verification §1.0 step 3).
Inert unless CLAUDE_AUTHENTICATED=1, since it needs an authenticated CLI.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

docs/open.md

@@ -148,9 +148,9 @@ Voraussetzung: Gitea-Release unter `git.kuns.dev/releases/ClaudeDo` mit `ClaudeD
 - `Hub/PlanningHubTests.cs`, `AgentSettingsHubTests.cs` decken Hub-Methoden via Fakes ab.
 - **Optional:** echter Roundtrip mit `WebApplicationFactory<Program>` + `HubConnectionBuilder` — niedriger Mehrwert.
 
-### 5.3 Smoke-Test gegen echten `claude` ⬜
-- `tests/.../Runner/ClaudeProcessSmokeTest.cs` existiert nicht. Real-CLI-Test als `[Fact(Skip=...)]`, nur lokal bei `CLAUDE_AUTHENTICATED=1`.
-- **Aufwand:** klein.
+### 5.3 Smoke-Test gegen echten `claude` ✅
+- `tests/ClaudeDo.Worker.Tests/Runner/ClaudeProcessSmokeTest.cs` spawnt das echte `claude`-Binary und prüft `ExitCode==0`, `SessionId`, non-empty `ResultMarkdown`, `TokensOut > 0` (deckt §1.0 Step 3 ab).
+- Inert ohne Opt-in (`CLAUDE_AUTHENTICATED=1`), da xUnit 2.5 kein dynamisches `Assert.Skip` hat (gleiche Konvention wie die `GitAvailable`-Guards). Lokal: `CLAUDE_AUTHENTICATED=1 dotnet test --filter FullyQualifiedName~ClaudeProcessSmokeTest`; Binary via `CLAUDEDO_CLAUDE_BIN` überschreibbar.
 
 ### 5.4 ExternalMcpService-Tests ✅
 - Service exponiert **18 Tools** (war 11): `ListTaskLists`, `ListTasks`, `GetTask`, `AddTask`, `UpdateTask`, `UpdateTaskStatus`, `ReviewTask`, `RunTaskNow`, `CancelTask`, `DeleteTask`, `GetTaskStatusValues`, `GetTaskWorktree`, `GetTaskDiff`, `MergeTask`, `ListWorktrees`, `CleanupTaskWorktree`, `GetDailyPrepCandidates`, `SetMyDay`.

tests/ClaudeDo.Worker.Tests/Runner/ClaudeProcessSmokeTest.cs

@@ -0,0 +1,60 @@
+using ClaudeDo.Worker.Config;
+using ClaudeDo.Worker.Runner;
+using Microsoft.Extensions.Logging.Abstractions;
+
+namespace ClaudeDo.Worker.Tests.Runner;
+
+// Real-CLI smoke test (plan-verification §1.0 step 3). Spawns the actual `claude`
+// binary and needs an authenticated session, so it is inert unless the developer
+// opts in with CLAUDE_AUTHENTICATED=1. Run locally with:
+//   CLAUDE_AUTHENTICATED=1 dotnet test tests/ClaudeDo.Worker.Tests \
+//     --filter FullyQualifiedName~ClaudeProcessSmokeTest
+// Override the binary with CLAUDEDO_CLAUDE_BIN if `claude` is not on PATH.
+public class ClaudeProcessSmokeTest
+{
+    private static bool Enabled =>
+        Environment.GetEnvironmentVariable("CLAUDE_AUTHENTICATED") == "1";
+
+    [Fact]
+    public async Task RunAsync_PingPrompt_ReturnsResultSessionAndTokens()
+    {
+        if (!Enabled)
+        {
+            Assert.True(true, "CLAUDE_AUTHENTICATED != 1 — skipping real-CLI smoke test");
+            return;
+        }
+
+        var cfg = new WorkerConfig
+        {
+            ClaudeBin = Environment.GetEnvironmentVariable("CLAUDEDO_CLAUDE_BIN") ?? "claude",
+        };
+        var sut = new ClaudeProcess(cfg, NullLogger<ClaudeProcess>.Instance);
+        var args = new ClaudeArgsBuilder().Build(new ClaudeRunConfig(
+            Model: null, SystemPrompt: null, AgentPath: null, ResumeSessionId: null,
+            MaxTurns: 3, PermissionMode: "auto"));
+
+        var workDir = Path.Combine(Path.GetTempPath(), $"claudedo_smoke_{Guid.NewGuid():N}");
+        Directory.CreateDirectory(workDir);
+
+        var lines = new List<string>();
+        try
+        {
+            using var cts = new CancellationTokenSource(TimeSpan.FromMinutes(2));
+            var result = await sut.RunAsync(
+                args,
+                "Reply with exactly the word: pong",
+                workDir,
+                line => { lock (lines) { lines.Add(line); } return Task.CompletedTask; },
+                cts.Token);
+
+            Assert.Equal(0, result.ExitCode);
+            Assert.False(string.IsNullOrWhiteSpace(result.SessionId), "session_id should be populated");
+            Assert.False(string.IsNullOrWhiteSpace(result.ResultMarkdown), "result should be non-empty");
+            Assert.True(result.TokensOut > 0, "output_tokens should be > 0");
+        }
+        finally
+        {
+            try { Directory.Delete(workDir, true); } catch { }
+        }
+    }
+}