Add smoke & exploit test suite — 27/27 pass

Audit fixes: tests/ dir, clean imports, reactive corpus, README polish