ci: verify managed run replay in workflow

[willamhou]

Summary

• extend the managed run workflow to verify a run, replay it, and then verify the replayed run
• factor the example shell helpers so replay and verification share the same run-selection logic
• update beta docs and examples to reflect replay as part of the managed runtime surface

Why

This keeps the CI/example wiring in a separate review from the runtime changes, while still exercising the replay loop that the managed beta now supports.

Validation

• bash -n examples/verify-managed-run.sh examples/replay-managed-run.sh examples/lib/managed-run-helpers.sh
• bash examples/verify-managed-run.sh --help
• bash examples/replay-managed-run.sh --help

Notes

• The runtime correctness fixes from managed: add run replay and durable terminal cleanup #16 are now on main, so this PR only carries the workflow/examples/docs layer.
• I did not run a live end-to-end gateway + secrets replay flow from this shell; the workflow wiring and local helper behavior were verified instead.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a24c5ffb5f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Fail --wait when managed run does not complete

In --wait mode the script captures terminal_status and logs it, but never enforces that the status is completed before continuing to hermes runs verify --strict. Because strict verification only checks Signet receipts/audit integrity (not run outcome), a replay that ends in failed, cancelled, or timed_out after emitting receipts can still make this step succeed, so the new workflow can report replay verification as green even when the replay execution itself failed.

Useful? React with 👍 / 👎.