END TO END WALKTHROUGHS. The only instruments in this build that a bad regex cannot fool.

WHY THEY EXIST. Twice in one night a grep produced a FALSE ABSENCE and I believed it. A character class of
[a-z0-9/_{}.-] with no A-Z hid every write route carrying a camelCase path parameter, which is most of them,
and I concluded the recruiting write path did not exist. It has 42 routes. I then "confirmed" it with a second
query using the same broken pattern and treated two failures of one instrument as agreement.

These scripts exercise the REAL authenticated API instead: genuine CSRF, genuine Origin check, genuine session,
real writes, then read the writes back. A route that does not exist fails here loudly and cannot be argued with.

  recruiting-funnel.sh   client, contact, requisition, candidate, source, six stage moves, interview and its
                         outcome, offer, acceptance, placement, then reads it all back. 25 assertions.
                         CONTROLS: a stale expected_stage must be refused (409), and an unpriced contract
                         offer must be refused (422). Without those two the other 23 prove much less.

  operator-console.sh    the platform plane. 13 assertions.
                         CONTROL FIRST: a NON operator must receive 404, not 403, because a 403 confirms the
                         surface exists to someone who should not know it does. Then operator list, validation
                         refusals, a real tenant provisioned, a duplicate slug conflicting rather than 500ing,
                         and the new owner redeeming the invite and logging in with tools already granted.

RUN
  BASE=https://missionmatch-staging.thatwebhostingguy.com \
  EMAIL=<user> PW=<password> bash recruiting-funnel.sh

  BASE=... OP_EMAIL=<operator> OP_PW=<pw> MGR_EMAIL=<non operator> MGR_PW=<pw> bash operator-console.sh

Fixture passwords are set with cmd/rotate-credential through MM_ROTATE_PASSWORD, which keeps them out of argv,
and they are recorded NOWHERE, per finding D4.