Wire one-shot vpnruntime guard script into CI

docs/operations/VPNRUNTIME_CI_FIXES_TRANSFER_2026-05-12.md

@@ -50,3 +50,9 @@ From `agents/rap-node-agent`:
 go test ./internal/vpnruntime -count=20
 go test -race ./internal/vpnruntime
 ```
+
+Or run the one-shot guard from repo root:
+
+```powershell
+pwsh -NoProfile -ExecutionPolicy Bypass -File scripts/smoke/run-vpnruntime-ci-guards.ps1
+```