Add isolated SIP call tool, optional debug capture and split interface schemas

deploys/test/README.md

@@ -16,7 +16,8 @@ systemd service or add it to a production host.
 
 ## Native Asterisk validation
 
-`nonprod-call-evidence.sh` is the mandatory capture-first wrapper for
+`nonprod-call-evidence.sh` is the capture-first wrapper used with
+`sip-go-agent agent --debug/-D` for
 non-production `mock`, `mixed` and explicit `nonprod-real` call checks. It runs on a validation
 host with native Asterisk and required diagnostics; it is not an Asterisk or
 Agent replacement and is not containerized. Run it explicitly with the current
@@ -32,7 +33,7 @@ restricted evidence ownership is recorded in `diagnostic-errors.txt` and fails
 the check; an already failed call keeps its nonzero result. Once live tcpdump
 and the PJSIP logger are running, the script creates a root-owned, group-readable
 `<call-id>.active` capture arm under `--proof-root` (default
-`/run/sip-go-agent/nonprod-armed`). The real Agent must set `AGENT_EVIDENCE_ROOT`
+`/run/sip-go-agent/nonprod-armed`). A debug-enabled real Agent must set `AGENT_EVIDENCE_ROOT`
 to this directory; it checks the exact approved event ID, trunk, raw callee,
 recent arm and live capture PID before origination. The script removes the arm
 before stopping capture. Run one approved call per invocation, with
@@ -55,8 +56,11 @@ mirror as described in [`cell/README.md`](../cell/README.md), with
 `AGENT_HEP_LISTEN_ADDR=127.0.0.1:<port>` matching `capture_address` in the
 private `hep.conf`. Confirm `res_hep` and `res_hep_pjsip` are running and the
 Agent's UDP listener is bound before any explicitly authorized trial. The
-capture-first wrapper remains mandatory; HEP is not a replacement for pcap,
-PJSIP logger, call-window checks, or caller approval. Verify the same
+capture-first wrapper is required only when Agent `--debug/-D` is enabled;
+normal Agent operation does not require tcpdump or external capture proofs.
+HEP's native SIP-response mirror, call-window checks and caller approval remain
+independent requirements. The standalone no-AI single-call tool and its optional
+pcap workflow are documented in [`cmd/sip-call/README.md`](../../cmd/sip-call/README.md). Verify the same
 `call.execute.result` is present in Dispatcher outbox and the SaaS Mock's
 restricted result store; inspect full `raw` only there and do not place it in
 logs, source, chat, or long-term evidence. A missing mirror produces a clear