ci(openclaw-acp-bridge): also run test_inbox_goudan.py in the smoke workflow (PR #30 round-7 follow-up)

The PR #30 round-7 fix removed the per-instance `base_url` constructor
parameter from `scripts/acp_inbox.py` and added `read(limit=...)`
forwarding to `_acp_client.inbox_read`. The contract is pinned by the
26-check `scripts/test_inbox_goudan.py` smoke (Checks 4 + 13b in
particular), but the existing workflow only ran `smoke.py` against
the stub. A regression on either round-7 property would land on the
PR with no CI signal.

This commit extends the `Run bundled smoke + goudan-side wrapper
tests` step to also invoke `test_inbox_goudan.py` against the same
live stub (one startup covers both). `unset SMOKE_SKIP_LIVE` is
applied before the wrapper smoke so its own CI fallback cannot
degrade the live checks to skipped.

Validation
----------
- Local CI step simulation: stub started with
  `--token ci-test-token-xyzzy --port 19999`, then
  `python smoke.py` and (after `unset SMOKE_SKIP_LIVE`)
  `python test_inbox_goudan.py` ran back-to-back. Wrapper smoke
  reported `PASSED: 41, FAILED: 0, SKIPPED: 0`, rc=0.
- Stub-backed roundtrip (Check 12) returned message_id=1; live
  read (Check 13) returned the written message; auth negatives
  (Check 14 missing / Check 15 wrong) both raised HTTPError 401.

Test evidence
-------------
- Negative-injection: removed `limit=limit,` from
  `acp_inbox.py:read()`, re-ran `test_inbox_goudan.py` CI-mode.
  Check 13b reported
    [FAIL] inbox_read was called with limit=42 (got None)
  and rc=1, with `PASSED: 30, FAILED: 1, SKIPPED: 8`. Restored
  the line; re-ran; rc=0 and `PASSED: 31, FAILED: 0, SKIPPED: 8`.
  The test is structural, not false-green.
- Live-mode re-run against the stub (ACP_TOKEN set, SMOKE_SKIP_LIVE
  unset): `PASSED: 41, FAILED: 0, SKIPPED: 0`, rc=0. All 26 checks
  (which expand to 41 individual assertions) exercise the
  documented wrapper surface.
- The `unset SMOKE_SKIP_LIVE` is a defensive no-op today (no prior
  step sets the variable) but matters for any future CI matrix
  step that might.

Design compliance
-----------------
- Skill-only Plugin: no `mcp.json`, no `package.json`, 0 npm
  dependencies. Workflow change is one .yml file; no new scripts.
- 4 disclosure sections in README intact (no credentials, no
  network, no telemetry, no third-party services); the workflow
  uses only the github-hosted `ubuntu-latest` runner and
  `actions/checkout` + `actions/setup-python`, both already in
  the file.
- Atomic write contract is unchanged. Cross-platform path
  resolution is unchanged: the path is hard-coded
  `plugins/antianqi/openclaw-acp-bridge/scripts/test_inbox_goudan.py`
  in the workflow (Linux), which is the path that the
  `actions/checkout` materialises from the PR branch.
- One commit, one concern: this commit only touches the workflow.
  No wrapper code, no test code, no Skill, no README, no
  `plugin.json` is modified.

Refs: PR #30 (hetaoBackend 2026-09-02T01:08:36Z, "Two public
wrapper parameters do not work as documented") and the round-7
fix `0995886` (this branch, "fix(openclaw-acp-bridge): remove
dead `base_url`, forward `read(limit=)`").

Author: antianqi

.github/workflows/openclaw-acp-bridge-smoke.yml

@@ -47,7 +47,7 @@ jobs:
           set -euo pipefail
           python plugins/antianqi/openclaw-acp-bridge/scripts/test_no_redirect.py
 
-      - name: Run bundled smoke test
+      - name: Run bundled smoke + goudan-side wrapper tests
         # Starts a stub ACP server (subclass of BaseHTTPRequestHandler)
         # and runs the smoke test against it. The stub implements
         # /acp/health, /acp/inbox/write, /acp/inbox/read with
@@ -62,6 +62,17 @@ jobs:
         # auth. The negative tests added in v0.2.1 (Check 8 missing
         # auth, Check 9 wrong auth) require the stub to be in the
         # "auth required" state.
+        #
+        # PR #30 round-7 amend: the goudan-side wrapper
+        # (scripts/acp_inbox.py) ships with its own 26-check smoke
+        # (scripts/test_inbox_goudan.py) that pins the round-7
+        # contract — constructor surface `['default_timeout']` only
+        # (per-instance `base_url` removed), and `read(limit=...)`
+        # forwards the kwarg to `_acp_client.inbox_read`. The wrapper
+        # smoke runs in this same step against the same stub (so
+        # one stub startup covers both), and `unset SMOKE_SKIP_LIVE`
+        # forces live mode (the wrapper's own CI fallback would
+        # otherwise degrade the live checks to skipped).
         env:
           ACP_TOKEN: 'ci-test-token-xyzzy'
           ACP_BASE_URL: 'http://127.0.0.1:19999'
@@ -73,6 +84,8 @@ jobs:
           trap "kill $STUB_PID 2>/dev/null || true" EXIT
           sleep 0.5
           python plugins/antianqi/openclaw-acp-bridge/scripts/smoke.py
+          unset SMOKE_SKIP_LIVE
+          python plugins/antianqi/openclaw-acp-bridge/scripts/test_inbox_goudan.py
 
       - name: Validate plugin manifest
         run: |