fix(deploy): smoke probe survives network failure (capture curl exit) + clearer label + 15s timeout

- C1 (Critical): Capture curl exit code instead of aborting script under set -e; network failures now
surface as FAIL lines with exit 1, not opaque curl exit codes like 7
- I1 (Important): Rename third probe label from "POST to unknown path is rejected" to
"fastapi :8000 not publicly routed (POST)" for clarity on test intent
- M3 (Minor): Add --max-time 15 to all curl calls to prevent indefinite hangs if HF Tornado
accepts TCP but stalls mid-response

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

scripts/smoke_hf_space.sh

@@ -13,12 +13,17 @@ FAIL=0
 
 probe() {
   local label="$1" url="$2" expect="$3" method="${4:-GET}"
-  local actual
+  local actual curl_exit=0
   if [[ "$method" == "POST" ]]; then
-    actual="$(curl -sS -o /dev/null -w "%{http_code}" -X POST \
-      -H 'content-type: application/json' -d '{}' "$url")"
+    actual="$(curl -sS --max-time 15 -o /dev/null -w "%{http_code}" \
+      -X POST -H 'content-type: application/json' -d '{}' "$url")" || curl_exit=$?
   else
-    actual="$(curl -sS -o /dev/null -w "%{http_code}" "$url")"
+    actual="$(curl -sS --max-time 15 -o /dev/null -w "%{http_code}" "$url")" || curl_exit=$?
+  fi
+  if [[ "$curl_exit" -ne 0 ]]; then
+    printf "  FAIL %-40s curl error %s\n" "$label" "$curl_exit"
+    FAIL=1
+    return
   fi
   if [[ "$actual" == "$expect" ]]; then
     printf "  OK   %-40s %s\n" "$label" "$actual"
@@ -31,7 +36,7 @@ probe() {
 echo "Probing $BASE"
 probe "frontend root"             "$BASE/"                       "200" "GET"
 probe "streamlit health"          "$BASE/_stcore/health"          "200" "GET"
-probe "POST to unknown path is rejected" "$BASE/predict/bbb"     "403" "POST"
+probe "fastapi :8000 not publicly routed (POST)" "$BASE/predict/bbb"     "403" "POST"
 
 echo
 if [[ "$FAIL" == "0" ]]; then