Harden production workflows and agent admission

deploy/showcase/checks/replay_check.sh

@@ -1,3 +1,15 @@
 #!/bin/sh
-echo "ok: replay tick"
+# PH-review: spool-replay scenario needs many DISTINCT events because the
+# server only persists an event row when the check status TRANSITIONS
+# (server/monlet_server/services/ingestion.py). Alternate ok/warning on each
+# run so every tick produces a fresh event for the spool to replay.
+STATE_FILE=/var/lib/monlet-agent/replay_tick
+COUNT=$(cat "$STATE_FILE" 2>/dev/null || echo 0)
+COUNT=$((COUNT + 1))
+echo "$COUNT" > "$STATE_FILE"
+if [ $((COUNT % 2)) -eq 0 ]; then
+  echo "warning: replay tick $COUNT"
+  exit 1
+fi
+echo "ok: replay tick $COUNT"
 exit 0