feat(bootstrap): shared docker provider + foundation-net precursor (ADR-006)

Composition substrate for Wave 2 (T03+):
- lib/context.ts: one Docker-over-SSH provider + DeployCtx threaded to component
  factories; FOUNDATION_DOCKER_HOST override for ephemeral validation.
- lib/versions.ts: resolve pinned images from VERSIONS; FOUNDATION_ALLOW_UNPINNED
  for local validation when digests are still PIN_DIGEST.
- components/network.ts: foundation-net (CONTRACT_003 §3.1).
- index.ts: phase-orchestration entrypoint with dependsOn gates; Wave-2 slots.
- ADR-006: shared-provider + per-component-factory model (egg does not route its
  phased bootstrap through the monolithic vendored DockerDeployments).

Validated: pulumi up over Docker-over-SSH created+verified+destroyed foundation-net
on crunchy01 (x86_64); ephemeral, nothing persisted. tsc + preview clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

bootstrap/lib/context.ts

@@ -0,0 +1,58 @@
+// lib/context.ts
+//
+// The shared deploy context every component receives (ADR-006). The bootstrap
+// creates ONE docker.Provider (Docker-over-SSH to the foundation VM) and ONE
+// foundation-net network; components then create their own container(s) against
+// this shared provider/network, which gives the bootstrap full control over
+// ordering and the phase GATES (e.g. Vault init between data-plane and Forgejo)
+// that the vendored monolithic DockerDeployments cannot express.
+//
+// Validation override: the committed Pulumi.foundation.yaml carries placeholder
+// VM coordinates (RFC-5737). For local/ephemeral validation against a dev Docker
+// host, export FOUNDATION_DOCKER_HOST=ssh://user@host to point the provider there
+// without editing committed config.
+import * as pulumi from "@pulumi/pulumi";
+import * as docker from "@pulumi/docker";
+import { FoundationConfig, sshPrivateKeyPath } from "../config";
+import { image } from "./versions";
+
+/** Base context: shared provider + helpers, before the network exists. */
+export interface BaseCtx {
+  cfg: FoundationConfig;
+  provider: docker.Provider;
+  sshKeyPath: string;
+  /** Resolve a pinned image by VERSIONS key suffix, e.g. ctx.image("POSTGRES"). */
+  image: (name: string) => string;
+}
+
+/** Full context handed to every component: base + the shared network. */
+export interface DeployCtx extends BaseCtx {
+  network: docker.Network;
+}
+
+/** Signature every Wave-2+ component factory follows (ADR-006). */
+export type ComponentFactory<T> = (ctx: DeployCtx) => T;
+
+function providerHost(cfg: FoundationConfig): string {
+  return process.env.FOUNDATION_DOCKER_HOST || `ssh://${cfg.vm.user}@${cfg.vm.host}`;
+}
+
+/**
+ * Build the shared Docker-over-SSH provider. SSH options mirror the vendored
+ * pulumi-docker wrapper (non-interactive host-key handling for automation).
+ */
+export function buildBaseContext(cfg: FoundationConfig): BaseCtx {
+  const sshKeyPath = sshPrivateKeyPath();
+  const provider = new docker.Provider("foundation-host", {
+    host: providerHost(cfg),
+    sshOpts: [
+      "-o",
+      "StrictHostKeyChecking=no",
+      "-o",
+      "UserKnownHostsFile=/dev/null",
+      "-i",
+      sshKeyPath,
+    ],
+  });
+  return { cfg, provider, sshKeyPath, image };
+}