[bpamiri]

Summary

The bug surface from the fresh-VM tutorial:

```
$ wheels test
Running core tests (sqlite)...
0 passed
```

— no spec discovery, no failure, no error. Tutorial chapter 7 asks users to write specs and run `wheels test`, but every invocation defaulted to core mode and pointed at framework specs the user didn't write.

Root cause (three layers)

1. CLI auto-detection was wrong. `Module.cfc::test` and `TestRunner.cfc::detectTestType` both keyed off "does `vendor/wheels/tests/` exist?" — but every Wheels app has the framework's tests vendored there, so the check was always true. `coreTests` defaulted to `true` for users.
2. App-mode endpoint had no usable runner. `Public.cfc::testbox()` (handler for `/wheels/app/tests`) just `include`d `/tests/runner.cfm` from the project root. `wheels new` doesn't scaffold one, so fresh apps got `Page [/tests/runner.cfm] not found`.
3. Reusing the framework's runner doesn't fit. `vendor/wheels/tests/runner.cfm` overrides `controllerPath`/`viewPath`/`modelPath` to framework test assets and hardcodes the `wheelstestdb_` datasource convention. Pointing user tests at it would break them.

Fix

1. `cli/lucli/Module.cfc` + `cli/lucli/services/TestRunner.cfc`

Default to app mode. `--core` (CLI flag) or `type: "core"` (service arg) is the explicit opt-in for framework specs. Updated `TestRunnerSpec` to assert the new behavior.

2. `vendor/wheels/Public.cfc::testbox()`

Prefer the project's `tests/runner.cfm` when it exists (advanced users with custom runners), but fall back to a new built-in runner when it doesn't.

3. `vendor/wheels/tests/app-runner.cfm` (new file)

Minimal TestBox-driven app-test runner. Scans `tests.specs.*` in the project root, emits the same JSON shape as the framework's core runner (so the CLI's `displayTestResults` parses it without a special case). Deliberately does NOT delegate to the framework runner — it would override paths and datasource in ways that break user tests.

Result

Smoke spec at `tests/specs/smoke/SimpleSpec.cfc`:

```cfm
component extends="wheels.WheelsTest" {
function run() {
describe("Simple smoke", () => {
it("can add", () => { expect(1 + 1).toBe(2); });
});
}
}
```

Now runs and reports counts via `wheels test`.

Test plan

• `bash tools/test-cli-local.sh` — 443 pass / 3 fail / 0 error. The 3 failures are pre-existing Doctor Service issues (packages: doctor mixin-collision scan is regex-based and may miss metadata-driven mixins #2260) unrelated to this change.
• `TestRunnerSpec` updated (one test rewritten to assert new "always returns app" behavior; cleanup test still asserts app mode without vendor dir).
• `bash tools/test-onboarding.sh` Phase 9 flips SKIP → PASS: "wheels test reports the smoke spec".

Closes #2318