Parameterises the public-surface smoke test by host (one required input, mapped via env: HOST). Keeps the three checks verbatim — login reachable, HSTS value pinned, Permissions-Policy present, /actuator -> 404 — plus the /proc/net/route gateway-detection and RESOLVE-array rationale. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>