Symptom

QA filed a second end-to-end smoke test (#219, the follow-up to #215) asking the dev-krill / krill-blue-bot loop to prove the full pipeline still works after the recent CI changes that landed since #215:

• ci(#217): preflight sudo + dropping the opened trigger from the Verify Agent Ghost workflow so the QA verify run only fires on the needs-qa-verify label being applied.
• ci(#213): rename Deploy Local Runner → Verify Agent Ghost.

The ask: blue runner picks up #219 from its assigned-open queue, branches, makes a small repo edit, opens a PR with needs-qa-verify, and the QA-verify Ghost run installs a deb whose Version: ends in +qaPR219.r<run>. QA confirms install + version match.

This is intentionally not a code-fixing issue — there is no bug. The “change” is a marker comment in README.md that proves the round trip end-to-end on the current main, not on the state #215 was cut from.

Root cause

N/A — verification round trip, not a fix. The work exercises the path:

1. dev-krill (krill-blue-bot, blue runner) picks up #219 from its assigned-and-open queue.
2. Branches fix/219-e2e-blue-runner-pr from current main (which now contains the #217 preflight-sudo fix), edits one line in README.md, commits, pushes, opens a PR labelled needs-qa-verify.
3. Verify Agent Ghost.yml (ghost runner) is triggered only by the label being applied (post-#217 there is no opened trigger), builds the four debs from the PR head, version-stamps them with +qaPR219.r<run>, installs them via the preflight-sudo’d block, and hands off to the QA agent.
4. QA confirms dpkg-query -W -f='${Version}\n' krill ends in +qaPR219.r<run>.

Fix

• Added a second HTML comment marker to README.md: <!-- e2e-test-marker: krill#219 — second blue-runner E2E ... -->. Smallest possible payload to produce a non-empty diff for CI; sits next to the #215 marker so the README carries a visible breadcrumb of every round trip.

Prevention

• This is a verification artifact, not a bugfix; the “regression test” is the QA verify run itself. If dpkg-query reports the right +qaPR219.r<n> suffix and the deb contents come from this PR’s head, the post-#217 pipeline is healthy.
• If the round trip succeeds for #219 but failed for #215 (or vice versa), bisect against the workflow changes between the two: the diff between this PR and the #215 PR is dominated by the #217 preflight-sudo fix and the trigger change in .github/workflows/Verify Agent Ghost.yml.
• Friction observed during this loop should be captured in PR comments (per the issue body) — not silently absorbed — so future iterations of the agent loop can compound on real signal.