fix(work): import hashlib and wire heal subparser into main CLI

bin/ensure-node-supervision.sh

@@ -7,6 +7,7 @@
 #      supervisors: cdp-relay-watchdog, agent-health.sh, relay-health-check,
 #      cdp-latency-check. Port from netvm-names pinning (honors
 #      CDP_PORT_OVERRIDE, so provision's picked port wins when present).
+#      Example/verify/probe names retire on sight (never active, no timer).
 #   2. chromebox-watchdog-<node>.timer unit + enable --now — the one
 #      supervisor that needs a per-node systemd unit (the @.service
 #      template already exists). Needs root for the real unit dir.
@@ -25,16 +26,38 @@ UNIT_DIR="${UNIT_DIR:-/etc/systemd/system}"
 
 usage() { echo "usage: ensure-node-supervision.sh <node> | --all" >&2; exit 1; }
 
-ensure_registry_row() {
+# Example/verify/probe nodes (onboarding drills, id-verify examples) must
+# never join active supervision: they carry no warp identity, wedge the
+# pinned registry contract, and spin chrome restarts forever. Match is
+# deliberately narrow (examp anywhere, test-/verify- prefixes) so real
+# node names containing those substrings elsewhere stay active.
+is_example_node() {
+  case "$1" in
+    *examp*|test*|verify-*|*-verify-*) return 0;;
+    *) return 1;;
+  esac
+}
+
+row_is_retired() {
   local node="$1"
+  grep -qE "^\|[[:space:]]*$node[[:space:]]*\|[^|]*\|[^|]*\|[^|]*\|[[:space:]]*retired[[:space:]]*\|" \
+    "$NODES_MD" 2>/dev/null
+}
+
+ensure_registry_row() {
+  local node="$1" status="active" note="auto-registered"
   if grep -qE "^\|[[:space:]]*$node[[:space:]]*\|" "$NODES_MD" 2>/dev/null; then
     echo "registry: $node already in NODES.md"
     return 0
   fi
   netvm_names "$node" || { echo "registry: unknown node $node" >&2; return 1; }
-  printf '| %s | %s | unknown | %s | active | %s (auto-registered) |\n' \
-    "$node" "$NETNS" "$CDP_PORT" "$node" >> "$NODES_MD"
-  echo "registry: added $node (port $CDP_PORT)"
+  if is_example_node "$node"; then
+    status="retired"
+    note="auto-registered example — retired"
+  fi
+  printf '| %s | %s | unknown | %s | %s | %s (%s) |\n' \
+    "$node" "$NETNS" "$CDP_PORT" "$status" "$node" "$note" >> "$NODES_MD"
+  echo "registry: added $node (port $CDP_PORT, $status)"
 }
 
 ensure_timer() {
@@ -72,6 +95,10 @@ EOF
 ensure_node() {
   local node="$1"
   ensure_registry_row "$node"
+  if row_is_retired "$node"; then
+    echo "timer: $node retired, skipping supervision"
+    return 0
+  fi
   ensure_timer "$node"
 }