Verification

./scripts/verify-fleet.sh --layer 1 --suite hub
./scripts/verify-hub-install.sh

Layered suites cover hub control plane, spoke registration, catalog smoke, and optional LLM paths. Prefer tags when repairing a single subsystem instead of full reinstall.

Security scan (no secrets in output):

./scripts/security-scan.sh --skip-images
./scripts/preflight-secrets.sh