Establish scoped KeyCape factor custody and verified automatic renewal

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c

tests/test_keycape_factor_activation.py

@@ -0,0 +1,15 @@
+import importlib.util,unittest
+from pathlib import Path
+spec=importlib.util.spec_from_file_location("activation",Path(__file__).resolve().parents[1]/"scripts/keycape_factor_activate.py")
+m=importlib.util.module_from_spec(spec);spec.loader.exec_module(m)
+class ActivationTests(unittest.TestCase):
+ def test_preserves_other_bytes_and_is_idempotent(self):
+  old=b"other: secret\nprivacyidea:\n  baseURL: http://provider\n  adminToken: expired\n  realm: coulomb\n  requireForAll: true\nclients:\n  - secret: unchanged\n"
+  new=m.rewrite_config(old)
+  self.assertEqual(old.replace(b"adminToken: expired",b"adminTokenFile: /etc/keycape-factor/admin-token"),new)
+  self.assertEqual(new,m.rewrite_config(new))
+ def test_rejects_ambiguous_source(self):
+  for text in (b"other: value\n",b"privacyidea:\n  adminToken: one\n  adminToken: two\n",b"privacyidea:\n  adminTokenFile: /unexpected\n"):
+   with self.assertRaises(ValueError):m.rewrite_config(text)
+ def test_refuses_unexpected_deployment(self):
+  with self.assertRaises(ValueError):m.deployment_patch({"metadata":{"uid":"replacement"}})