Split kind tests into component-owned probes

docs/spec/testing.md

@@ -37,9 +37,9 @@ The fixture provides PostgreSQL, Redis and DragonflyDB, Keycloak and ZITADEL,
 and Garage and VersityGW. Images and fixture tools are checksum or
 digest-pinned.
 
-`make check-dependencies` creates the complete fixture, verifies each released
-dependency image through its product interface, and destroys the fixture.
-`make check-kind-matrix` runs a fixture-consumer Job sequentially across the
+`make check-dependencies` creates the complete fixture, runs the Haskell
+dependency probe against each released product interface, and destroys the
+fixture. `make check-kind-matrix` runs the Haskell fixture probe sequentially across the
 Redis/DragonflyDB × Keycloak/ZITADEL × Garage/VersityGW matrix without
 deploying Nuthatch. `make check-app` deploys Nuthatch and runs its smoke Job
 across the Redis/DragonflyDB × Garage/VersityGW matrix. `make app-up` retains
@@ -72,6 +72,14 @@ retained. Locally built application or test images are loaded with
 `load_local_image`; released dependencies always use the digest-pinned images
 from `tests/kind/versions.env`.
 
+`tests/kind/lib.sh` is a compatibility facade over the fixture modules.
+The shared core owns only paths, the explicit Kubernetes wrapper, locking, and
+Job observation. Runtime-provider setup, dependency deployment, lane
+selection, PostgreSQL, Redis-compatible coordination, OIDC, target
+provisioning, profiles, and lane cleanup have separate modules under
+`tests/kind/fixture/`. Job manifests configure and launch one component-owned
+Haskell probe; they do not contain shell test programs.
+
 The host provides rootless nerdctl and containerd at the versions recorded in
 `tests/kind/versions.env`, together with `ctr`, `curl`, `flock`, `jq`, and
 `sha256sum`. The fixture downloads its pinned kind and kubectl binaries.