feat(tests): implement live VM acceptance test strategy (TODO-006 to TODO-010)

docs/todo/TODO-006.md

@@ -0,0 +1,31 @@
+# PRD #2 - Task 1/5: VM inventory, SSH fixture, and safety guards
+
+**Tags:** `task`, `prd-2`
+
+## Parent PRD
+
+PRD #2: Isolated live-system acceptance test strategy on Debian 12 VM (`docs/prd/PRD-002-live-vm-test-strategy.md`)
+
+## What to build
+
+Create the VM inventory config schema (host/IP, SSH user/key, OS family). Implement the SSH connection fixture and the multi-layer safety guards that abort if the target could be the local machine. Write tests for the guards without executing any workflow.
+
+## Acceptance criteria
+
+- [ ] Inventory config schema documented and validated.
+- [ ] SSH fixture connects only when target is explicitly allowed.
+- [ ] Guards block `localhost`, `127.*`, current hostname, local interfaces, and unknown SSH host keys.
+- [ ] Guard tests run on the local machine and prove the blocks work.
+
+## Blocked by
+
+None — can start immediately.
+
+## Next task
+
+- TODO-007 (PRD #2 - Task 2/5: Scenario loader and Klipper install scenario)
+
+## User stories addressed
+
+- User story 5
+- User story 6

docs/todo/TODO-007.md

@@ -0,0 +1,32 @@
+# PRD #2 - Task 2/5: Scenario loader and Klipper install scenario
+
+**Tags:** `task`, `prd-2`
+
+## Parent PRD
+
+PRD #2: Isolated live-system acceptance test strategy on Debian 12 VM (`docs/prd/PRD-002-live-vm-test-strategy.md`)
+
+## What to build
+
+Implement the YAML scenario loader and the `live` pytest marker. Write the first end-to-end scenario: install Klipper on the Debian 12 VM, define expected outcomes (service file, env file, folders), and run it with snapshot revert before the scenario.
+
+## Acceptance criteria
+
+- [ ] YAML scenario loader parses `name`, `os`, `steps`, and `expected` assertions.
+- [ ] `pytest -m live` runs only live scenarios; default run skips them.
+- [ ] Klipper install scenario runs on the VM and passes.
+- [ ] Snapshot revert happens before the scenario.
+- [ ] Expected outcomes include file, service, and folder assertions.
+
+## Blocked by
+
+- TODO-006 (PRD #2 - Task 1/5: VM inventory, SSH fixture, and safety guards)
+
+## Next task
+
+- TODO-008 (PRD #2 - Task 3/5: Remove Klipper and Moonraker scenarios)
+
+## User stories addressed
+
+- User story 1
+- User story 7

docs/todo/TODO-008.md

@@ -0,0 +1,30 @@
+# PRD #2 - Task 3/5: Remove Klipper and Moonraker scenarios
+
+**Tags:** `task`, `prd-2`
+
+## Parent PRD
+
+PRD #2: Isolated live-system acceptance test strategy on Debian 12 VM (`docs/prd/PRD-002-live-vm-test-strategy.md`)
+
+## What to build
+
+Add remove-Klipper and install/remove-Moonraker scenarios. Each scenario starts from a clean snapshot. Capture relevant VM logs when a scenario fails to make debugging actionable.
+
+## Acceptance criteria
+
+- [ ] Remove Klipper scenario runs and verifies service/files are gone.
+- [ ] Install Moonraker scenario runs and verifies service/config/log files.
+- [ ] Remove Moonraker scenario runs and verifies cleanup.
+- [ ] Failure output includes tail of installer/service logs.
+
+## Blocked by
+
+- TODO-007 (PRD #2 - Task 2/5: Scenario loader and Klipper install scenario)
+
+## Next task
+
+- TODO-009 (PRD #2 - Task 4/5: Mainsail and Fluidd install scenarios)
+
+## User stories addressed
+
+- User story 2

docs/todo/TODO-009.md

@@ -0,0 +1,30 @@
+# PRD #2 - Task 4/5: Mainsail and Fluidd install scenarios
+
+**Tags:** `task`, `prd-2`
+
+## Parent PRD
+
+PRD #2: Isolated live-system acceptance test strategy on Debian 12 VM (`docs/prd/PRD-002-live-vm-test-strategy.md`)
+
+## What to build
+
+Add install scenarios for Mainsail and Fluidd web clients. Assert that the static files are deployed and the reverse-proxy/service config is in place. Harden the snapshot-revert fixture so it runs reliably before every scenario.
+
+## Acceptance criteria
+
+- [ ] Mainsail install scenario passes on the VM.
+- [ ] Fluidd install scenario passes on the VM.
+- [ ] Expected outcomes check webroot directory and reverse-proxy config.
+- [ ] Snapshot revert fixture is robust (wait for SSH, error on revert failure).
+
+## Blocked by
+
+- TODO-008 (PRD #2 - Task 3/5: Remove Klipper and Moonraker scenarios)
+
+## Next task
+
+- TODO-010 (PRD #2 - Task 5/5: Backup, restore, and update scenarios)
+
+## User stories addressed
+
+- User story 3

docs/todo/TODO-010.md

@@ -0,0 +1,32 @@
+# PRD #2 - Task 5/5: Backup, restore, and update scenarios
+
+**Tags:** `task`, `prd-2`
+
+## Parent PRD
+
+PRD #2: Isolated live-system acceptance test strategy on Debian 12 VM (`docs/prd/PRD-002-live-vm-test-strategy.md`)
+
+## What to build
+
+Add backup/restore and update scenarios. Document the live test runbook: how to prepare the VM, set inventory, run scenarios, and read results. Ensure the whole live suite can be executed in one command.
+
+## Acceptance criteria
+
+- [ ] Backup scenario creates an archive with expected content.
+- [ ] Restore scenario returns config files to expected state.
+- [ ] Update scenario changes a component version/config observable on the VM.
+- [ ] Runbook `docs/live-testing.md` covers VM setup, inventory, execution, and troubleshooting.
+- [ ] Full `pytest -m live` run completes end-to-end.
+
+## Blocked by
+
+- TODO-009 (PRD #2 - Task 4/5: Mainsail and Fluidd install scenarios)
+
+## Next task
+
+None — this is the last task.
+
+## User stories addressed
+
+- User story 4
+- User story 7