Add demo cleanup dry-run smoke

backend/README.md

@@ -191,6 +191,9 @@ bash scripts/live_migration_smoke.sh
   apply runs above `--max-delete` until the cap is raised after a dry-run review.
   Use repeated `--export-type` values to target only specific artifact kinds.
   In Docker, use `docker compose exec -T backend python scripts/cleanup_demo_artifacts.py`.
+- Live cleanup validation is available with `bash scripts/verify_demo_cleanup_dry_run.sh`.
+  It runs the same maintenance path without `--apply` and fails if the summary
+  reports anything other than a dry-run with zero deleted exports/files.
 
 ## Run locally
 

backend/tests/test_readiness_gate.py

@@ -39,6 +39,25 @@ def test_readiness_gate_compiles_demo_cleanup_script() -> None:
     assert "-m py_compile backend/scripts/cleanup_demo_artifacts.py" in content
 
 
+def test_readiness_gate_checks_demo_cleanup_dry_run_script_syntax() -> None:
+    script = Path(__file__).resolve().parents[2] / "scripts" / "run_readiness_check.sh"
+    content = script.read_text(encoding="utf-8")
+
+    assert "bash -n scripts/verify_demo_cleanup_dry_run.sh" in content
+
+
+def test_demo_cleanup_dry_run_script_is_dry_run_only() -> None:
+    script = Path(__file__).resolve().parents[2] / "scripts" / "verify_demo_cleanup_dry_run.sh"
+    content = script.read_text(encoding="utf-8")
+
+    assert "--apply" not in content
+    assert "deleted_export_count=0" in content
+    assert "dry_run=true" in content
+    assert "candidate_exports" in content
+    assert "CLEANUP_MODE" in content
+    assert "project_report_html" in content
+
+
 def test_readiness_gate_compiles_yolo_preflight_script() -> None:
     script = Path(__file__).resolve().parents[2] / "scripts" / "run_readiness_check.sh"
     content = script.read_text(encoding="utf-8")