Context

Follow-up from #1279 / #1282 (merged in e7bb2625).

Problem

The container daemon-lifecycle smoke test scripts/docker/test-daemon-lifecycle.sh re-implements bring-up and health-poll logic that already lives inline in .github/workflows/validate_docker_image.yml:

• the docker run -d block with the -e NETCLAW_Providers__validate__* / NETCLAW_Models__Main__* minimal-provider env contract, and
• the curl …/api/health/ready + docker inspect '{{.State.Running}}' poll loop.

So the port, the health path, the minimal-config env contract, and the crash-bail logic now live in 2–3 shell copies across the workflow and the script. A change to any of them (health route rename, an added required env var, a longer startup budget) updates one copy and silently leaves the other testing a stale contract — i.e. a gate that passes while exercising the wrong setup.

Proposal

Extract a single shared bring-up + wait-healthy helper (e.g. a sourced snippet under scripts/docker/) and call it from both validate_docker_image.yml's steps and test-daemon-lifecycle.sh. One source of truth for the port / health path / provider-env contract.

Scope

Test-maintainability cleanup; non-blocking. Orthogonal to #1279/#1282.