[tim-smart]

Moves the testBench group onto HttpApi: listItems, run, startRuleTest, getRuleTest and getRuleTestInput (R9, R10, R11, W3, W13).

Cluster and domain

• packages/domain/src/Api/TestBench.ts defines the group, and JanitorApi adds it. apps/cluster/src/Ingress/TestBench.ts serves it, and Routes.ts merges that layer.
• RuleTestJob moves to Labeling/Policy/Test.ts. The cluster's Payload and Row structs stay where they are.
• New RuleTestNotFound { testId } (404) in Labeling/Policy/Configuration.ts. It covers a missing job and an expired input snapshot.
• startRuleTest answers HttpApiError.BadRequest unless it tests exactly one item against a draft or a policy. A draft that fails validation gets PolicyInvalid { diagnostic }. The 202 no longer sends Retry-After: 1.
• RuleTestJobs now fails with RepositoryBlocked { reason: "disconnected" } on both enqueue and get when the repository is no longer connected. Before, that case returned RepositoryNotFound. SQL, outbox, row decode and configuration failures die. The handlers also turn LabelingTestError and LabelingConfigurationError into defects. LabelingTest itself keeps its error types, because the rule-test workflow matches on its failures to record "The test could not finish".
• TestRequest.numbers is now optional in the type as well as on the wire. This follows CreateRuleRequest from Move janitor's rules routes onto HttpApi #135, because the derived client sends the schema's Type. LabelingTest reads an absent list as empty.
• The raw LabelingRoutes.ts drops the five test bench routes.

Web

• test-bench.ts runs through api.testBench.run. workspace.ts loads test items through listItems. rule-editor.ts starts, polls and inspects rule tests through startRuleTest, getRuleTest and getRuleTestInput.
• Commands decode their plain-string subject into the domain TestRequest before sending. They turn tags into page copy with catchTag/catchTags, and orElseSucceed covers everything else.
• The labeling-wire.ts copies of TestEntity, TestResponse and AiInputDetails go, along with testEndpoint. TestSubject stays, because it is the editor's free-JSON form, like ProgramSource.

Validation

• vp check: 0 errors. No new warnings in the changed files.
• vp test: 820 passed, 2 failed. Tests were kept unchanged on purpose for this run, so both failures are known test problems, to be fixed in a separate test cleanup:
  • test/Ingress/LabelingRoutes.test.ts > "runs tests, sets AI consent and refuses cross-site writes" still posts to the raw /test route, which now lives in the HttpApi group. Its /test assertion and the LabelingTest and RuleTestJobs stubs should go. The same stubs in Routes.test.ts are now unused, but harmless.
  • test/Ingress/TestBench.test.ts > "lists items, runs a test…" expects the enqueued draft exactly as sent. The server decodes the payload, which adds the condition's default caseSensitive: false. The fixture's matchesWhen needs caseSensitive: false.

Closes EFF-2522