Address review: README Test entry, wrapper cautions, internal smoke run

- README cheat sheet: add a Test entry documenting the plan-only/mocked,
  credential-free workflow and the Terraform >= 1.7 requirement.
- quilt smoke wrapper: comment that new quilt inputs must be threaded through
  (or coverage silently narrows) and that the root must re-expose only the
  non-sensitive stack name.
- Add an internal = true new-VPC smoke run, exercising the PublicSubnets/
  UserSubnets coalescing and the internal-gated api endpoint.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: sir-sigurd

README.md

@@ -917,6 +917,18 @@ terraform fmt
 terraform validate
 ```
 
+## Test
+
+Module tests are plan-only and mock the AWS provider, so they need no AWS
+credentials and create no infrastructure. Requires Terraform >= 1.7 (for
+`mock_provider`). Run from a module or test-wrapper directory, e.g.
+`modules/vpc` or `modules/quilt/tests/smoke`:
+
+```
+terraform init -backend=false
+terraform test
+```
+
 ## Plan
 ```
 terraform plan -out tfplan

modules/quilt/tests/smoke/main.tf

@@ -57,6 +57,8 @@ variable "user_security_group" {
   default = null
 }
 
+# New inputs added to the quilt module must be threaded through here, or the
+# smoke coverage silently narrows (the new input is never exercised).
 module "quilt" {
   source = "../../"
 
@@ -73,6 +75,10 @@ module "quilt" {
   user_security_group = var.user_security_group
 }
 
+# Re-expose ONLY the non-sensitive stack name. Do not output module.quilt.stack
+# (it embeds the DB URL + admin password) or any *_password value — a sensitive
+# root output makes `terraform test` fail, which is the whole reason this
+# wrapper exists.
 output "stack_name" {
   value = module.quilt.stack.name
 }

modules/quilt/tests/smoke/smoke.tftest.hcl

@@ -30,6 +30,21 @@ run "new_vpc_plans" {
   }
 }
 
+run "new_vpc_internal_plans" {
+  command = plan
+  variables {
+    create_new_vpc = true
+    internal       = true
+  }
+  # internal = true exercises the most conditional wiring in quilt/main.tf:
+  # the PublicSubnets/UserSubnets null-coalescing and the internal-gated api
+  # endpoint.
+  assert {
+    condition     = output.stack_name == "quilt-test"
+    error_message = "The CloudFormation stack must be named after var.name"
+  }
+}
+
 run "existing_vpc_plans" {
   command = plan
   variables {