Full test suite is now the mandatory final validation; fix everything it surfaced

- Policy: every change ends with make test (all tiers, all tests) green; docs and agent guardrails updated accordingly
- schema.py: ensure the full filtered/indexed column set of instances via get_table (ingress_slug, ports_json, container_gateway, slug, status, ...) so a partial first insert can never break the ingress proxy
- docs_api: award body param location body -> json; gateway endpoints documented public -> user to match enforced auth
- tests: missing get_table import (trash restore), audit read as admin (award), deterministic online-roster and leaderboard-cache handling, container visibility updated to the primary-admin-only rule, scoped AI usage heading selector past the hidden Tools nav links

tests/api/game/index.py

@@ -87,15 +87,23 @@ def test_leaderboard_entries_carry_score_and_prestige(app_server, seeded_db):
     session, name = _signup()
     _reset_farm(name)
     _set_farm(name, prestige=50, total_harvests=20, ci_tier=3)
-    response = requests.get(f"{BASE_URL}/game/leaderboard", headers=JSON)
-    assert response.status_code == 200
-    entries = response.json()["entries"]
+    deadline = time.time() + 20
+    while True:
+        response = requests.get(f"{BASE_URL}/game/leaderboard", headers=JSON)
+        assert response.status_code == 200
+        entries = response.json()["entries"]
+        mine = next(
+            (entry for entry in entries if entry["username"] == name), None
+        )
+        if mine is not None or time.time() >= deadline:
+            break
+        time.sleep(0.5)
     assert entries
     scores = [entry["score"] for entry in entries]
     assert scores == sorted(scores, reverse=True)
     for entry in entries:
         assert "score" in entry and "prestige" in entry
-    mine = next(entry for entry in entries if entry["username"] == name)
+    assert mine is not None
     assert mine["prestige"] == 50
     assert mine["score"] == economy.farm_score(store.get_farm(
         get_table("users").find_one(username=name)["uid"]