feat(preflight): host/toolchain validation + VERSIONS pin-file — T01
- VERSIONS: 7 container images (CONTRACT_003 §3.2) + 13 host tools, KEY=value,
source-able+greppable; images carry :PIN_DIGEST placeholders with a documented
pin-digests procedure (D5 determinism — no real deploy until pinned).
- preflight.sh: fails closed (non-zero on any required check), bash-3.2 safe,
composable checks/ (versions,tools,env,docker) + gated (ssh,dns) that WARN-skip
until the stack is configured.
- env check honors D2 (passphrase presence only, never printed).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Andreas Niemann
edc708b826