Implement reproducible S1 handoff contracts

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02994-7685-7940-bf34-3555b8256018

terraform/hetzner/inventory_selection.tftest.hcl

@@ -0,0 +1,53 @@
+mock_provider "hcloud" {}
+mock_provider "template" {}
+
+run "adopted_host_is_not_managed" {
+  command = plan
+
+  variables {
+    hcloud_token   = "fixture-not-a-credential"
+    inventory_yaml = <<-YAML
+      schema_version: "1.0"
+      servers:
+        - name: adopted-host
+          provider: hosteurope
+          lifecycle_mode: adopted
+          ip: 192.0.2.10
+          ssh_user: admin
+          baseline_profile: ufw-managed
+    YAML
+  }
+
+  assert {
+    condition     = length(output.managed_server_names) == 0
+    error_message = "adopted Host Europe records must not select Hetzner resources"
+  }
+}
+
+run "managed_hetzner_host_is_selected" {
+  command = plan
+
+  variables {
+    hcloud_token   = "fixture-not-a-credential"
+    inventory_yaml = <<-YAML
+      schema_version: "1.0"
+      servers:
+        - name: fixture-hetzner-01
+          provider: hetzner
+          lifecycle_mode: provider-managed
+          ssh_user: admin
+          baseline_profile: ufw-managed
+          provisioning:
+            server_type: cpx21
+            region: nbg1
+            image: ubuntu-24.04
+            role: fixture
+            labels: [test]
+    YAML
+  }
+
+  assert {
+    condition     = length(output.managed_server_names) == 1 && output.managed_server_names[0] == "fixture-hetzner-01"
+    error_message = "provider-managed Hetzner records must be selected"
+  }
+}