feat(openbao): add autonomy runtime v1 candidate

deploy/openbao-autonomy/admin-bootstrap-openbao-autonomy-v1-v3.self-test.json

@@ -0,0 +1 @@
+{"checks": {"72h_acceptance_gate": true, "approle_implemented": true, "audit_implemented": true, "backup_implemented": true, "branch_protection_gate_not_bypassable": true, "charter_store_sign_verify": true, "continuous_optimization_implemented": true, "declarative_self_initialization": true, "embedded_shell_syntax": true, "exact_checksum_duplicate_rejected": true, "exact_checksum_good_fixture": true, "exact_checksum_missing_rejected": true, "fault_injection_implemented": true, "gitea_1_22_6_rejected": true, "gitea_1_23_0_accepted": true, "gitea_tag_api_version_gate": true, "isolated_restore_implemented": true, "kv_v2_implemented": true, "machine_credential_persisted": true, "no_git_force_push": true, "no_git_tag_mutation": true, "openbao_ready_gate_not_bypassable": true, "outer_bash_syntax": true, "policy_implemented": true, "ready_not_predeclared": true, "root_token_not_persisted": true, "self_contained_no_sibling_preflight": true, "self_init_secret_removal_implemented": true, "tag_protection_gate_implemented": true, "transit_charter_key_implemented": true, "transit_runtime_key_implemented": true}, "passed": 31, "runtime_claims": false, "schema": "AIOS_OPENBAO_BOOTSTRAP_STATIC_SELF_TEST_V3", "scope": "static_and_fixture_only", "script_sha256": "4bece5edc8be5d2024b5b81ce569549625c2bf318fdaed1066773b379b76cc66", "total": 31}

deploy/openbao-autonomy/admin-bootstrap-openbao-autonomy-v1-v3.sha256

@@ -0,0 +1 @@
+4bece5edc8be5d2024b5b81ce569549625c2bf318fdaed1066773b379b76cc66  admin-bootstrap-openbao-autonomy-v1-v3.sh

deploy/openbao-autonomy/checksums.sha256

@@ -0,0 +1,4 @@
+aa5a8eb14e80d23c2e3f8a36cdeea4b3cd026877eb4aa424637a85665388e6ec  admin-bootstrap-openbao-autonomy-v1-v3.self-test.json
+4bece5edc8be5d2024b5b81ce569549625c2bf318fdaed1066773b379b76cc66  admin-bootstrap-openbao-autonomy-v1-v3.sh
+b400b9427cd37cb7bbba85313081aeb93f0f3181cbfbab99948c793f30d3c53e  admin-bootstrap-openbao-autonomy-v1-v3.sha256
+c355df01c83c2801ae3a0df43806c562ee70f97c9aa558e3f67dd097efa5ac99  test-admin-bootstrap-openbao-autonomy-v1-v3.sh

deploy/openbao-autonomy/test-admin-bootstrap-openbao-autonomy-v1-v3.sh

@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+umask 077
+
+script="${1:-$(CDPATH= cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)/admin-bootstrap-openbao-autonomy-v1-v3.sh}"
+report="${2:-$(CDPATH= cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)/admin-bootstrap-openbao-autonomy-v1-v3.self-test.json}"
+
+[[ -f "$script" ]] || {
+  printf 'missing script: %s\n' "$script" >&2
+  exit 66
+}
+
+bash -n "$script"
+tmp="$(mktemp)"
+trap 'rm -f "$tmp"' EXIT
+bash "$script" --self-test >"$tmp"
+
+python3 - "$script" "$tmp" <<'PY'
+import hashlib
+import json
+import pathlib
+import sys
+
+script, report = map(pathlib.Path, sys.argv[1:])
+data = json.loads(report.read_text())
+actual_hash = hashlib.sha256(script.read_bytes()).hexdigest()
+
+assert data["schema"] == "AIOS_OPENBAO_BOOTSTRAP_STATIC_SELF_TEST_V3"
+assert data["scope"] == "static_and_fixture_only"
+assert data["runtime_claims"] is False
+assert data["script_sha256"] == actual_hash
+assert data["passed"] == data["total"]
+assert all(data["checks"].values())
+PY
+
+install -m 0600 "$tmp" "$report"
+printf 'PASS bash-n + embedded static/fixture tests\n'
+printf 'report=%s\n' "$report"
+sha256sum "$script"