feat(openbao): add autonomy runtime v1 candidate

deploy/openbao-autonomy/admin-bootstrap-openbao-autonomy-v1-v3.self-test.json

@@ -0,0 +1 @@
+{"checks": {"72h_acceptance_gate": true, "approle_implemented": true, "approle_secret_not_persisted_in_hcl": true, "approle_secret_survives_isolated_restore": true, "audit_implemented": true, "autonomy_tls_readers_use_ca_only_bind": true, "backup_implemented": true, "backup_restore_share_without_openbao_private_key_group": true, "branch_protection_gate_not_bypassable": true, "charter_store_sign_verify": true, "continuous_optimization_implemented": true, "controller_uses_charter_only_bind": true, "declarative_self_initialization": true, "embedded_shell_syntax": true, "exact_checksum_duplicate_rejected": true, "exact_checksum_good_fixture": true, "exact_checksum_missing_rejected": true, "fault_injection_does_not_require_service_it_kills": true, "fault_injection_failure_phase_evidence": true, "fault_injection_implemented": true, "fault_injection_missing_seal_reaches_static_seal_validation": true, "fault_injection_systemd_sandbox": true, "gitea_1_22_6_rejected": true, "gitea_1_23_0_accepted": true, "gitea_1_27_nonempty_tag_allowlist": true, "gitea_probe_traversal_and_cleanup": true, "gitea_tag_api_version_gate": true, "isolated_restore_implemented": true, "isolated_restore_uses_private_ephemeral_audit_sink": true, "kv_v2_implemented": true, "machine_credential_persisted": true, "masked_systemd_units_do_not_change_dev_null": true, "no_git_force_push": true, "no_git_tag_mutation": true, "openbao_2_6_heredoc_compatible": true, "openbao_2_6_runtime_verifier": true, "openbao_config_memfd_injection": true, "openbao_ready_gate_not_bypassable": true, "outer_bash_syntax": true, "policy_implemented": true, "ready_not_predeclared": true, "restored_approle_login_has_bounded_readiness_retry": true, "root_token_not_persisted": true, "runtime_state_directory_remains_writable": true, "self_contained_no_sibling_preflight": true, "self_init_marker_bound_to_raft_lifecycle": true, "self_init_secret_removal_implemented": true, "systemd_credentials_mandatory": true, "systemd_runtime_directories": true, "tag_protection_gate_implemented": true, "transit_charter_key_implemented": true, "transit_runtime_key_implemented": true}, "passed": 52, "runtime_claims": false, "schema": "AIOS_OPENBAO_BOOTSTRAP_STATIC_SELF_TEST_V3", "scope": "static_and_fixture_only", "script_sha256": "f687e17b1806e4f4265013b85e2cc3b4472f508720856fc8374607e7d20dbcc6", "total": 52}

deploy/openbao-autonomy/admin-bootstrap-openbao-autonomy-v1-v3.sha256

@@ -0,0 +1 @@
+f687e17b1806e4f4265013b85e2cc3b4472f508720856fc8374607e7d20dbcc6  admin-bootstrap-openbao-autonomy-v1-v3.sh

deploy/openbao-autonomy/checksums.sha256

@@ -0,0 +1,4 @@
+6bd0d51fbdd1c90df2f6ea8c667edecfaf892aaf76744c41757979407af0d424  admin-bootstrap-openbao-autonomy-v1-v3.self-test.json
+f687e17b1806e4f4265013b85e2cc3b4472f508720856fc8374607e7d20dbcc6  admin-bootstrap-openbao-autonomy-v1-v3.sh
+b7aa70280a417cebaa0363380024dc378714267de5d2eeb681b16a4f610a6ce5  admin-bootstrap-openbao-autonomy-v1-v3.sha256
+c355df01c83c2801ae3a0df43806c562ee70f97c9aa558e3f67dd097efa5ac99  test-admin-bootstrap-openbao-autonomy-v1-v3.sh

deploy/openbao-autonomy/test-admin-bootstrap-openbao-autonomy-v1-v3.sh

@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+umask 077
+
+script="${1:-$(CDPATH= cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)/admin-bootstrap-openbao-autonomy-v1-v3.sh}"
+report="${2:-$(CDPATH= cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)/admin-bootstrap-openbao-autonomy-v1-v3.self-test.json}"
+
+[[ -f "$script" ]] || {
+  printf 'missing script: %s\n' "$script" >&2
+  exit 66
+}
+
+bash -n "$script"
+tmp="$(mktemp)"
+trap 'rm -f "$tmp"' EXIT
+bash "$script" --self-test >"$tmp"
+
+python3 - "$script" "$tmp" <<'PY'
+import hashlib
+import json
+import pathlib
+import sys
+
+script, report = map(pathlib.Path, sys.argv[1:])
+data = json.loads(report.read_text())
+actual_hash = hashlib.sha256(script.read_bytes()).hexdigest()
+
+assert data["schema"] == "AIOS_OPENBAO_BOOTSTRAP_STATIC_SELF_TEST_V3"
+assert data["scope"] == "static_and_fixture_only"
+assert data["runtime_claims"] is False
+assert data["script_sha256"] == actual_hash
+assert data["passed"] == data["total"]
+assert all(data["checks"].values())
+PY
+
+install -m 0600 "$tmp" "$report"
+printf 'PASS bash-n + embedded static/fixture tests\n'
+printf 'report=%s\n' "$report"
+sha256sum "$script"