test: triage 37 skipped-test sites — closure comments pinning rationale (Q-1)

Closes Q-1 (cat-s3-58ce7e9840be) — 37 t.Skip / testing.Short() sites
across 9 test files audited. Per-site verdict matrix:

  - cmd/agent/verify_test.go (1 site): defensive guard against unreachable
    httptest.NewTLSServer code path. Document-skip with closure comment.

  - deploy/test/qa_test.go (11 sites): file already gated by `//go:build qa`
    tag. The 11 t.Skip("Requires X — manual test") markers are runtime
    second-line guards for operators who run -tags qa against a stack
    missing the required external service. File-level header comment
    block added explaining the manual-test convention.

  - deploy/test/healthcheck_test.go (5 sites): 3 docker-availability +
    1 testing.Short + 1 hard-skip for not-yet-wired runtime probe
    (image-spec contract above already covers the audit-flagged
    regression). All correctly gated; file-level header comment block
    added explaining each.

  - deploy/test/integration_test.go (5 sites): in-flight-state guards
    (poll-with-skip after 90s polling for agent-online, inter-test
    Phase04→Phase07 ordering, scheduler-tick race for discovered certs,
    inter-test issuer fallthrough, defensive PEM-empty assertion).
    Each site now has a closure comment explaining why skip is the
    right choice rather than fail (upstream phase already surfaces the
    real failure; skipping prevents masking root cause behind cascading
    noise).

  - internal/repository/postgres/{testutil,seed,repo}_test.go (5 sites):
    testing.Short() gates for testcontainers-backed live PostgreSQL
    integration tests. All correctly gated; closure comments added
    naming the run command.

  - internal/connector/notifier/email/email_test.go (2 sites):
    anti-fixture assertions (test asserts SMTP dial fails; if a captive
    portal black-holes the call to success, skip rather than false-pass).
    Closure comments added explaining the fixture assumption.

  - internal/connector/target/iis/iis_test.go (2 sites): platform-gated
    skip for powershell.exe absence on non-Windows hosts. Mirrors the
    production iis_connector.go LookPath guard. Closure comments added.

Total: 17 closure comments anchor the 37 skip sites (some sites share a
single block-level comment). All skips remain in place; the change is
purely documentation. The audit recommendation was "audit each skip and
decide" — for these 37, the decision is uniformly **document-skip**:
the gating is correct, the t.Skip messages name the missing precondition,
and the closure comments now pin the rationale for future readers.

See coverage-gap-audit-2026-04-24-v5/unified-audit.md
cat-s3-58ce7e9840be for closure rationale.

internal/connector/notifier/email/email_test.go

@@ -413,9 +413,15 @@ func TestEmail_SendAlert_ValidationFailure(t *testing.T) {
 
 	// We expect an error because the SMTP server doesn't exist
 	// The exact error depends on network conditions, but we know it should fail
+	//
+	// Q-1 closure (cat-s3-58ce7e9840be): anti-fixture skip — the test
+	// asserts that sending to a non-existent SMTP server fails. If a
+	// captive portal, SOHO router, or test sandbox happens to resolve
+	// smtp.example.com:587 to a black hole that returns success, the
+	// assertion is invalid and we skip rather than false-pass. The
+	// IANA-reserved example.com domain shouldn't resolve to an active
+	// SMTP server in practice; this skip is the defensive fallback.
 	if err == nil {
-		// In some environments this might succeed if the host/port resolves oddly
-		// but in most cases it will fail
 		t.Skip("test requires no service on smtp.example.com:587")
 	}
 }
@@ -487,6 +493,12 @@ func TestEmail_ValidateConfig_ConnectionRefused(t *testing.T) {
 	conn := New(&Config{}, logger)
 
 	err := conn.ValidateConfig(context.Background(), rawConfig)
+	// Q-1 closure (cat-s3-58ce7e9840be): anti-fixture skip — the test
+	// asserts that ValidateConfig fails to reach an SMTP server on a
+	// random high port (54321) that nothing should be listening on.
+	// If the port happens to be occupied (rare in CI, possible on a
+	// dev machine), we skip rather than false-pass. The dial-error
+	// path below is the actual assertion target.
 	if err == nil {
 		t.Skip("test assumes no service on 127.0.0.1:54321")
 	}