Record verified enrollment assurance release and automate provider contract tests

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c

.forgejo/workflows/acceptance.yaml

@@ -2,7 +2,7 @@ name: Authentication acceptance
 on:
   push:
     branches: [main]
-    paths: ["src/**", ".forgejo/workflows/acceptance.yaml"]
+    paths: ["src/**", "scripts/provider-onboarding-contract.py", ".forgejo/workflows/acceptance.yaml"]
   workflow_dispatch:
 jobs:
   acceptance:
@@ -18,3 +18,23 @@ jobs:
           tar xzf /tmp/keycape-source.tar.gz -C /tmp/keycape-acceptance --strip-components=1
           cd /tmp/keycape-acceptance/src
           /usr/local/go/bin/go test ./...
+
+  provider-contract:
+    runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/gpappsoft/privacyidea-docker@sha256:af7841adad262f129e0c1d4f553af13f21cb2f4dc713533f316cfe43ed0b4473
+    steps:
+      - name: Exercise isolated provider enrollment and recovery
+        run: |
+          python3 - <<'PYCODE'
+          import os,tarfile,tempfile,urllib.request,subprocess
+          from pathlib import Path
+          with tempfile.TemporaryDirectory(prefix='keycape-provider-ci-') as directory:
+              root=Path(directory)
+              url='https://forgejo.coulomb.social/'+os.environ['GITHUB_REPOSITORY']+'/archive/'+os.environ['GITHUB_SHA']+'.tar.gz'
+              with urllib.request.urlopen(url,timeout=30) as response,tempfile.TemporaryFile() as archive:
+                  archive.write(response.read());archive.seek(0)
+                  with tarfile.open(fileobj=archive,mode='r:gz') as tar:tar.extractall(root,filter='data')
+              script=next(root.glob('*/scripts/provider-onboarding-contract.py'))
+              subprocess.run(['python3',str(script)],check=True,timeout=90)
+          PYCODE