feat(bootstrap): Bun-workspace skeleton + typed config + vendored modules — T02

- Bun workspaces (packages/* + bootstrap); Pulumi nodejs runtime under
  packagemanager: bun (no npm fallback needed).
- bootstrap/config.ts: typed FoundationConfig per CONTRACT_001; loadConfig()
  fails closed, aggregating all missing+malformed keys in one error. Reads flat
  dotted keys; image digests excluded (they live in VERSIONS, D5).
- bootstrap/Pulumi.foundation.yaml: non-secret placeholders only (RFC-5737 vm.host,
  .invalid offsite); no encryptionsalt/secrets committed (D2). pulumi preview = 0
  resources under the passphrase provider via gitignored file:// state backend.
- Stage-1 vendoring: packages/pulumi-{docker,vault} as @olsitec/* (source-only,
  logic unchanged). vault's 5 type-only imports from modules/olsitec re-homed
  verbatim into pulumi-vault/olsitec-types.ts to keep the egg self-contained.

Realizes PLAN-002 §10 T02; ADR-005 / 000_TOPOLOGY.md §5 Stage-1.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packages/pulumi-vault/olsitec-types.ts

@@ -0,0 +1,90 @@
+// olsitec-types.ts
+//
+// VENDORING NOTE (Stage-1, 2026-06-30 — see VENDORED.md):
+//   The upstream olsicloud4 `modules/vault/index.ts` imports five PURELY TYPE-LEVEL
+//   declarations from its sibling `../../modules/olsitec`:
+//
+//       OlsitecProjectFeatureFlags, OlsitecCredentialTypes,
+//       GitProjectCredentials, OciRegistryCredentials, MinioBackupProjectCredentials
+//
+//   That sibling module transitively pulls in `modules/minio`, `modules/gitlab`,
+//   and `modules/kubernetes`, none of which belong in the foundation egg and none
+//   of which are vendored. To keep the vault module SELF-CONTAINED inside the
+//   foundation workspace WITHOUT changing any runtime behaviour, these five type
+//   declarations are copied here VERBATIM from
+//   `olsicloud4/pulumi/modules/olsitec/index.ts` (definitions only — no logic, no
+//   ComponentResource), and `index.ts`'s import is re-pointed from
+//   `../../modules/olsitec` to `./olsitec-types`.
+//
+//   This is a type-only re-home; the vault module's logic is unchanged.
+import * as pulumi from "@pulumi/pulumi";
+
+export type OlsitecCredentialTypes = {
+  minioBackupEndpoint?: string;
+  minioBackupAccessKey?: pulumi.Output<string>;
+  minioBackupSecretKey?: pulumi.Output<string>;
+  cockroachdbAdminUser?: string;
+  cockroachdbAdminPassword?: pulumi.Output<string>;
+  cockroachdbServiceUser?: string;
+  cockroachdbServicePassword?: pulumi.Output<string>;
+  mongodbAdminUser?: string;
+  mongodbAdminPassword?: pulumi.Output<string>;
+  mongodbBackupUser?: string;
+  mongodbBackupPassword?: pulumi.Output<string>;
+  mongodbServiceUser?: string;
+  mongodbServicePassword?: pulumi.Output<string>;
+  mongodbKeyfile?: pulumi.Output<string>;
+  minioAdminUser?: string;
+  minioAdminPassword?: pulumi.Output<string>;
+  minioServiceUser?: string;
+  minioServicePassword?: pulumi.Output<string>;
+  rustfsAdminUser?: string;
+  rustfsAdminPassword?: pulumi.Output<string>;
+  rustfsServiceUser?: string;
+  rustfsServicePassword?: pulumi.Output<string>;
+  garageRpcSecret?: pulumi.Output<string>;
+  garageAdminToken?: pulumi.Output<string>;
+  garageServiceKeyId?: pulumi.Output<string>;
+  garageServiceKeySecret?: pulumi.Output<string>;
+  natsToken?: pulumi.Output<string>;
+  grafanaAdminPassword?: pulumi.Output<string>;
+  postgresUser?: string;
+  postgresPassword?: pulumi.Output<string>;
+  postgresServiceUser?: string;
+  postgresServicePassword?: pulumi.Output<string>;
+  basicAuthUser?: string;
+  basicAuthPassword?: pulumi.Output<string>;
+  basicAuthHtpasswd?: pulumi.Output<string>;
+  nominatimPassword?: pulumi.Output<string>;
+};
+
+export type OlsitecProjectFeatureFlags =
+  | "minioBackup"
+  | "cockroachdb"
+  | "vault"
+  | "mongodb"
+  | "nats"
+  | "minio"
+  | "rustfs"
+  | "garage"
+  | "grafana"
+  | "postgres"
+  | "basicAuth"
+  | "nominatim";
+
+export type OciRegistryCredentials = {
+  ociRegistryAddress: string;
+  ociRegistryUser: pulumi.Input<string>;
+  ociRegistryPassword: pulumi.Input<string>;
+};
+
+export type GitProjectCredentials = {
+  gitArgocdUser: pulumi.Input<string>;
+  gitArgocdToken: pulumi.Input<string>;
+};
+
+export type MinioBackupProjectCredentials = {
+  minioBackupEndpoint: pulumi.Input<string>;
+  minioBackupAccessKey: pulumi.Output<string>;
+  minioBackupSecretKey: pulumi.Output<string>;
+};