test(relay): cross-package e2e adversarial security harness

New e2e/ package wires the REAL P5(auth)+P4(crypto)+P2(agent) exports through
in-memory seams and an untrusted-relay attacker vantage (RelaySpy). Dynamically
re-validates F1–F4/F6 plus MITM/reflection/replay/reorder/INV2/cross-tenant/
single-use — every assertion runs the production code path. 21 tests green, tsc
clean. node_modules via symlinks (gitignored); no npm install needed.

e2e/tests/smoke.test.ts

@@ -0,0 +1,21 @@
+import { describe, it, expect } from 'vitest'
+// Cross-package resolution smoke test: prove the harness can bare-import the REAL exports of
+// every relay package (each resolves via its own node_modules/relay-contracts symlink transitively).
+import { issueCapabilityToken, onUpgrade, needsStepUp } from 'relay-auth'
+import { createClientHandshake, createHostHandshake, createE2ESession, deriveContentKey } from 'relay-e2e'
+import { createReplaySealer } from 'agent'
+import { CapabilityTokenSchema } from 'relay-contracts'
+
+describe('cross-package import smoke', () => {
+  it('resolves the real exports of relay-auth / relay-e2e / agent / relay-contracts', () => {
+    expect(typeof issueCapabilityToken).toBe('function')
+    expect(typeof onUpgrade).toBe('function')
+    expect(typeof needsStepUp).toBe('function')
+    expect(typeof createClientHandshake).toBe('function')
+    expect(typeof createHostHandshake).toBe('function')
+    expect(typeof createE2ESession).toBe('function')
+    expect(typeof deriveContentKey).toBe('function')
+    expect(typeof createReplaySealer).toBe('function')
+    expect(CapabilityTokenSchema).toBeDefined()
+  })
+})