Implement reproducible S1 handoff contracts

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02994-7685-7940-bf34-3555b8256018

scripts/hcloud_new_server.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 # hcloud_new_server.sh — Add a host to inventory and provision it on Hetzner
 # Usage:
-#   scripts/hcloud_new_server.sh <NAME> [--type cpx11] [--region nbg1] [--role web] [--image ubuntu-24.04] [--user admin]
+#   scripts/hcloud_new_server.sh <NAME> [options] [--apply]
 #
 # Prereqs:
 #   - age + SOPS installed, with access to decrypt your Hetzner token
@@ -23,6 +23,7 @@ REGION="nbg1"
 ROLE="generic"
 IMAGE="ubuntu-24.04"
 USER="admin"
+APPLY=false
 
 while [[ $# -gt 0 ]]; do
   case "$1" in
@@ -31,6 +32,7 @@ while [[ $# -gt 0 ]]; do
     --role)   ROLE="$2"; shift 2;;
     --image)  IMAGE="$2"; shift 2;;
     --user)   USER="$2"; shift 2;;
+    --apply)  APPLY=true; shift;;
     *) fail "Unknown arg: $1 (usage: scripts/hcloud_new_server.sh <NAME> [--type cpx11] [--region nbg1] [--role web] [--image ubuntu-24.04] [--user admin])";;
   esac
 done
@@ -58,18 +60,27 @@ python3 scripts/new_host.py \
   --region "$REGION" \
   --role "$ROLE" \
   --image "$IMAGE" \
-  --user "$USER"
+  --user "$USER" \
+  --reuse-existing
 
 ok "Inventory updated: $NAME → inventory/servers.yaml"
 
 # --- Decrypt Hetzner token and apply Terraform ---
-HCLOUD_TOKEN="$(sops -d --extract '["hetzner"]["token"]' secrets/hetzner-token.sops.yaml 2>/dev/null)"
-[[ -n "$HCLOUD_TOKEN" ]] || fail "Could not decrypt ops.hcloud_token from secrets/hetzner-token.sops.yaml. Ensure SOPS_AGE_KEY or keys.txt is set and token exists."
+HCLOUD_TOKEN="$(sops -d --extract '["hetzner"]["token"]' secrets/hetzner-token.yaml 2>/dev/null)"
+[[ -n "$HCLOUD_TOKEN" ]] || fail "Could not decrypt hetzner.token from secrets/hetzner-token.yaml. Ensure SOPS_AGE_KEY or keys.txt is set."
 
 pushd terraform/hetzner >/dev/null
 
 terraform init -upgrade
-export HCLOUD_TOKEN
+export TF_VAR_hcloud_token="$HCLOUD_TOKEN"
+terraform plan
+
+if [[ "$APPLY" != true ]]; then
+  info "Plan complete; no provider mutation performed. Re-run with --apply only after review and approval."
+  popd >/dev/null
+  exit 0
+fi
+
 terraform apply -auto-approve
 
 # Try to show IP of the created host