Establish scoped KeyCape factor custody and verified automatic renewal

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c

.forgejo/workflows/keycape-factor-acceptance.yaml

@@ -0,0 +1,26 @@
+name: KeyCape factor custody acceptance
+on:
+  push:
+    branches: [main]
+    paths: ["scripts/keycape_factor_*.py", "tests/test_keycape_factor_*.py", "openbao/policies/*keycape-factor*.hcl", "manifests/keycape-factor-custody.yaml", ".forgejo/workflows/keycape-factor-acceptance.yaml"]
+  workflow_dispatch:
+jobs:
+  acceptance:
+    runs-on: ubuntu-latest
+    container:
+      image: python:3.12-slim@sha256:d764629ce0ddd8c71fd371e9901efb324a95789d2315a47db7e4d27e78f1b0e9
+    steps:
+      - name: Test exact source revision
+        run: |
+          set -eu
+          python3 - <<'PYCODE'
+          import os,tarfile,tempfile,urllib.request
+          from pathlib import Path
+          root=Path('/tmp/factor-acceptance');root.mkdir()
+          url='https://forgejo.coulomb.social/'+os.environ['GITHUB_REPOSITORY']+'/archive/'+os.environ['GITHUB_SHA']+'.tar.gz'
+          with urllib.request.urlopen(url,timeout=30) as response,tempfile.TemporaryFile() as archive:
+              archive.write(response.read());archive.seek(0)
+              with tarfile.open(fileobj=archive,mode='r:gz') as tar:tar.extractall(root,filter='data')
+          PYCODE
+          cd /tmp/factor-acceptance/*
+          PYTHONDONTWRITEBYTECODE=1 python3 -m unittest discover -s tests -p 'test_keycape_factor_*.py'