test: triage 37 skipped-test sites — closure comments pinning rationale (Q-1)

Closes Q-1 (cat-s3-58ce7e9840be) — 37 t.Skip / testing.Short() sites
across 9 test files audited. Per-site verdict matrix:

  - cmd/agent/verify_test.go (1 site): defensive guard against unreachable
    httptest.NewTLSServer code path. Document-skip with closure comment.

  - deploy/test/qa_test.go (11 sites): file already gated by `//go:build qa`
    tag. The 11 t.Skip("Requires X — manual test") markers are runtime
    second-line guards for operators who run -tags qa against a stack
    missing the required external service. File-level header comment
    block added explaining the manual-test convention.

  - deploy/test/healthcheck_test.go (5 sites): 3 docker-availability +
    1 testing.Short + 1 hard-skip for not-yet-wired runtime probe
    (image-spec contract above already covers the audit-flagged
    regression). All correctly gated; file-level header comment block
    added explaining each.

  - deploy/test/integration_test.go (5 sites): in-flight-state guards
    (poll-with-skip after 90s polling for agent-online, inter-test
    Phase04→Phase07 ordering, scheduler-tick race for discovered certs,
    inter-test issuer fallthrough, defensive PEM-empty assertion).
    Each site now has a closure comment explaining why skip is the
    right choice rather than fail (upstream phase already surfaces the
    real failure; skipping prevents masking root cause behind cascading
    noise).

  - internal/repository/postgres/{testutil,seed,repo}_test.go (5 sites):
    testing.Short() gates for testcontainers-backed live PostgreSQL
    integration tests. All correctly gated; closure comments added
    naming the run command.

  - internal/connector/notifier/email/email_test.go (2 sites):
    anti-fixture assertions (test asserts SMTP dial fails; if a captive
    portal black-holes the call to success, skip rather than false-pass).
    Closure comments added explaining the fixture assumption.

  - internal/connector/target/iis/iis_test.go (2 sites): platform-gated
    skip for powershell.exe absence on non-Windows hosts. Mirrors the
    production iis_connector.go LookPath guard. Closure comments added.

Total: 17 closure comments anchor the 37 skip sites (some sites share a
single block-level comment). All skips remain in place; the change is
purely documentation. The audit recommendation was "audit each skip and
decide" — for these 37, the decision is uniformly **document-skip**:
the gating is correct, the t.Skip messages name the missing precondition,
and the closure comments now pin the rationale for future readers.

See coverage-gap-audit-2026-04-24-v5/unified-audit.md
cat-s3-58ce7e9840be for closure rationale.

internal/repository/postgres/repo_test.go

@@ -1937,6 +1937,9 @@ func seedPendingJobs(t *testing.T, ctx context.Context, db *sql.DB, certID strin
 // semantics: a single call transitions Pending rows to Running atomically, and
 // the rows returned to the caller reflect the post-update state.
 func TestJobRepository_ClaimPendingJobs_FlipsToRunning(t *testing.T) {
+	// Q-1 closure (cat-s3-58ce7e9840be): exercises the SKIP-LOCKED claim
+	// SQL against a live PostgreSQL via testcontainers-go. Run with:
+	//   go test -count=1 ./internal/repository/postgres/... (omit -short)
 	if testing.Short() {
 		t.Skip("integration test requires PostgreSQL")
 	}
@@ -1993,6 +1996,9 @@ func TestJobRepository_ClaimPendingJobs_FlipsToRunning(t *testing.T) {
 // an atomic progress counter before exiting, so transient SKIP-LOCKED zeros do
 // not cause premature termination.
 func TestJobRepository_ClaimPendingJobs_ConcurrentDisjoint(t *testing.T) {
+	// Q-1 closure (cat-s3-58ce7e9840be): concurrent claim semantics
+	// require true row-level locking — only PostgreSQL provides this.
+	// Run with: go test -count=1 ./internal/repository/postgres/... (omit -short)
 	if testing.Short() {
 		t.Skip("integration test requires PostgreSQL")
 	}
@@ -2100,6 +2106,10 @@ func TestJobRepository_ClaimPendingJobs_ConcurrentDisjoint(t *testing.T) {
 // Running; AwaitingCSR rows are returned but their state is preserved (the CSR
 // submission path drives their next transition).
 func TestJobRepository_ClaimPendingByAgentID_TransitionsDeployments(t *testing.T) {
+	// Q-1 closure (cat-s3-58ce7e9840be): Pending→Running deployment-job
+	// transition vs CSR-flow preservation requires the live PostgreSQL
+	// transactional semantics. Run with:
+	//   go test -count=1 ./internal/repository/postgres/... (omit -short)
 	if testing.Short() {
 		t.Skip("integration test requires PostgreSQL")
 	}

internal/repository/postgres/seed_test.go

@@ -84,6 +84,9 @@ func TestRunSeed_AppliesIdempotently(t *testing.T) {
 // We point at a directory that exists (empty temp dir) but contains no
 // seed.sql. RunSeed must return nil silently.
 func TestRunSeed_MissingFileIsNoOp(t *testing.T) {
+	// Q-1 closure (cat-s3-58ce7e9840be): RunSeed opens a *sql.DB connection
+	// against the live PostgreSQL testcontainer. Run with:
+	//   go test -count=1 ./internal/repository/postgres/... (omit -short)
 	if testing.Short() {
 		t.Skip("skipping integration test in short mode")
 	}

internal/repository/postgres/testutil_test.go

@@ -30,6 +30,11 @@ type testDB struct {
 func setupTestDB(t *testing.T) *testDB {
 	t.Helper()
 
+	// Q-1 closure (cat-s3-58ce7e9840be): live PostgreSQL needed via
+	// testcontainers-go (postgres:16-alpine). Run with:
+	//   go test -count=1 ./internal/repository/postgres/... (omit -short)
+	// The short-mode gate keeps it off the default `go test ./... -short`
+	// fast loop where docker-in-docker may not be available.
 	if testing.Short() {
 		t.Skip("skipping integration test in short mode")
 	}