Implement reproducible S1 handoff contracts

Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02994-7685-7940-bf34-3555b8256018
2026-08-23 12:02:23 +02:00 · 2026-08-23 12:02:23 +02:00 · b93af8cc78
commit b93af8cc78
parent c8cb1c8edf
44 changed files with 2035 additions and 342 deletions
--- a/docs/sops-rotation-approval.example.yaml
+++ b/docs/sops-rotation-approval.example.yaml
@ -0,0 +1,10 @@
+# Metadata-only example. Copy outside Git for an attended approved rotation.
+approved: false
+approved_by: "operator-name"
+approved_at: "2026-08-23T00:00:00Z"
+changes:
+  - path: secrets/hetzner-token.yaml
+    before_recipients:
+      - age1old-example-not-valid
+    after_recipients:
+      - age1new-example-not-valid