Wire one-shot vpnruntime guard script into CI

.github/workflows/build.yml

@@ -37,6 +37,8 @@ jobs:
         run: go test ./internal/vpnruntime -run TestFabricClientPacketIngressParallelFlowWindowDoesNotBlockIndependentChannel -count=50 -timeout=60s
       - name: Concurrency check (vpnruntime race)
         run: go test -race ./internal/vpnruntime
+      - name: One-shot vpnruntime guard script
+        run: pwsh -NoProfile -ExecutionPolicy Bypass -File scripts/smoke/run-vpnruntime-ci-guards.ps1 -AntiFlakeCount 20 -TargetedCount 50
 
   worker:
     runs-on: ubuntu-24.04

docs/operations/VPNRUNTIME_CI_FIXES_TRANSFER_2026-05-12.md

@@ -50,3 +50,9 @@ From `agents/rap-node-agent`:
 go test ./internal/vpnruntime -count=20
 go test -race ./internal/vpnruntime
 ```
+
+Or run the one-shot guard from repo root:
+
+```powershell
+pwsh -NoProfile -ExecutionPolicy Bypass -File scripts/smoke/run-vpnruntime-ci-guards.ps1
+```