feat(bootstrap): shared docker provider + foundation-net precursor (ADR-006)

Composition substrate for Wave 2 (T03+):
- lib/context.ts: one Docker-over-SSH provider + DeployCtx threaded to component
  factories; FOUNDATION_DOCKER_HOST override for ephemeral validation.
- lib/versions.ts: resolve pinned images from VERSIONS; FOUNDATION_ALLOW_UNPINNED
  for local validation when digests are still PIN_DIGEST.
- components/network.ts: foundation-net (CONTRACT_003 §3.1).
- index.ts: phase-orchestration entrypoint with dependsOn gates; Wave-2 slots.
- ADR-006: shared-provider + per-component-factory model (egg does not route its
  phased bootstrap through the monolithic vendored DockerDeployments).

Validated: pulumi up over Docker-over-SSH created+verified+destroyed foundation-net
on crunchy01 (x86_64); ephemeral, nothing persisted. tsc + preview clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

bootstrap/index.ts

@@ -1,37 +1,50 @@
-// index.ts — the foundation egg entrypoint (PLAN-002 §0, Layer 0).
+// index.ts — foundation bootstrap entrypoint (the egg, PLAN-002 §0, Layer 0).
 //
-// T02 SCAFFOLD STATE: this entrypoint is intentionally a NO-OP beyond config
-// validation. It calls loadConfig() so that `pulumi preview` exercises the
-// CONTRACT_001 fail-closed validation (acceptance T02), but it creates NO real
-// resources yet. The data plane / Vault / RustFS / Postgres / Forgejo / Caddy /
-// runner components are LATER tasks (PLAN-002 §10: T03–T15) and are deliberately
-// NOT authored here.
-import * as pulumi from "@pulumi/pulumi";
+// Phase orchestration (PLAN-002 §2, §5). Components are created against the shared
+// provider + foundation-net (ADR-006); GATES between phases are Pulumi dependsOn
+// edges, NOT imperative sequencing, so `pulumi up` derives the order. Wave-2+ tasks
+// fill the marked slots — this file is the single composition point; components stay
+// pure factories in components/*.
+import { loadConfig } from "./config";
+import { buildBaseContext, DeployCtx } from "./lib/context";
+import { deployNetwork } from "./components/network";
 
-import { loadConfig, sshPrivateKeyPath } from "./config";
+const cfg = loadConfig();
 
-// Fail closed here: if required config is missing/malformed, loadConfig throws
-// and `pulumi preview` reports the full gap (CONTRACT_001 §Validation).
-const config = loadConfig();
+// --- shared substrate: provider + network (always first) ---
+const base = buildBaseContext(cfg);
+const network = deployNetwork(base);
+const ctx: DeployCtx = { ...base, network };
 
-// The vendored @olsitec/pulumi-docker provider (CONTRACT_003) will, in T03+, use
-// this key path + config.vm.{host,user} to reach the foundation VM over SSH.
-// Resolved here only to prove the ENV channel is wired; not yet consumed.
-const sshKeyPath = sshPrivateKeyPath();
+// =============================================================================
+// PHASE 3 — DATA PLANE  (depends on: network)
+//   T03 postgres · T04 rustfs · T05 vault (sealed)
+// -----------------------------------------------------------------------------
+// const postgres = deployPostgres(ctx);
+// const rustfs   = deployRustfs(ctx);
+// const vault    = deployVault(ctx);
+//
+// --- GATE A: Vault init + unseal (T05) → writes unseal keys to encrypted config;
+//     credentials.ts (T06) dependsOn the init resource.
+// const credentials = deployCredentials(ctx, { postgres, rustfs, vault });
+//
+// =============================================================================
+// PHASE 6 — FORGE  (depends on: credentials, GATE A)
+//   T07 caddy · T08 forgejo · T10 runner
+// -----------------------------------------------------------------------------
+// const proxy   = deployProxy(ctx);
+// const forgejo = deployForgejo(ctx, { postgres, rustfs, credentials, proxy });
+//   --- GATE B: Forgejo healthy → handover (T11) + runner registration (T10).
+// const runner  = deployRunner(ctx, { forgejo, credentials });
+// =============================================================================
 
-pulumi.log.info(
-  `foundation config loaded (no-op scaffold): ` +
-    `baseDomain=${config.baseDomain}, vm=${config.vm.user}@${config.vm.host}, ` +
-    `network=${config.network.name} (${config.network.subnet}), tls=${config.tls.mode}`,
-);
-
-// Stack outputs — safe, non-secret echoes so `pulumi preview`/`up` has something
-// to show while no resources exist. Replaced by real component outputs in T03+.
-export const phase = "T02-scaffold";
-export const baseDomain = config.baseDomain;
-export const networkName = config.network.name;
-export const vmTarget = pulumi.interpolate`${config.vm.user}@${config.vm.host}`;
-export const sshKeyConfigured = sshKeyPath.length > 0;
-export const enabledFeatures = Object.entries(config.features)
+// Stack outputs (extended as phases land).
+export const phase = "T03-precursor"; // network + shared provider only
+export const networkName = network.name;
+export const vmTarget = `${cfg.vm.user}@${cfg.vm.host}`;
+export const enabledFeatures = Object.entries(cfg.features)
   .filter(([, on]) => on)
   .map(([name]) => name);
+
+// ctx is consumed by the Wave-2 slots above once uncommented.
+void ctx;