Run one bounded unauthenticated public GET, compare optional status and body-text assertions, and return reproducible bug-triage evidence and next actions.