Harden backup credentials and add durable image inventory publication

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ecb-456a-71c2-b41e-0755d336e883

tests/test_backup_credentials.py

@@ -0,0 +1,51 @@
+import os
+from pathlib import Path
+import subprocess
+import unittest
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+class BackupCredentialTests(unittest.TestCase):
+    def run_shell(self, body):
+        env = {k: v for k, v in os.environ.items() if not k.startswith("RAILIANCE_BACKUP_")}
+        return subprocess.run(
+            ["bash", "-c", 'source lib/railiance-backup-common.sh\n' + body],
+            cwd=ROOT, env=env, text=True, capture_output=True,
+        )
+
+    def test_missing_credentials_fail_with_safe_error(self):
+        result = self.run_shell(
+            'bao() { return 1; }\nrailiance_backup_require_openbao_lane'
+        )
+        self.assertNotEqual(result.returncode, 0)
+        self.assertEqual(result.stdout, "")
+        self.assertIn("governed backup credential unavailable", result.stderr)
+        self.assertNotIn("unbound variable", result.stderr)
+
+    def test_explicit_governed_credentials_need_no_bao(self):
+        result = self.run_shell('''
+bao() { echo unexpected-bao >&2; return 1; }
+RAILIANCE_BACKUP_NC_TOKEN=test-only-placeholder
+RAILIANCE_BACKUP_NC_WEBDAV_URL=https://example.invalid/upload
+railiance_backup_require_openbao_lane
+''')
+        self.assertEqual(result.returncode, 0)
+        self.assertEqual(result.stdout + result.stderr, "")
+
+    def test_openbao_lane_supplies_missing_credentials(self):
+        result = self.run_shell('''
+bao() {
+  case "$*" in
+    "kv metadata get "*) return 0 ;;
+    "kv get -field=NC_WEBDAV_TOKEN "*) echo test-only-placeholder ;;
+    "kv get -field=NC_WEBDAV_URL "*) echo https://example.invalid/upload ;;
+    *) return 1 ;;
+  esac
+}
+railiance_backup_require_openbao_lane
+[[ "$RAILIANCE_BACKUP_NC_TOKEN" == test-only-placeholder ]]
+[[ "$RAILIANCE_BACKUP_NC_WEBDAV_URL" == https://example.invalid/upload ]]
+''')
+        self.assertEqual(result.returncode, 0)
+        self.assertEqual(result.stdout + result.stderr, "")