feat: add rmgr rapp init/validate/pin-image

Prove the user-engine wrapper shape and give Repo Manager a
secret-free scaffolder that refuses invented rails and live-contract
overwrites.

src/repo_manager/cli.py

@@ -4,9 +4,13 @@ from __future__ import annotations
 
 import argparse
 import json
-import sys
 from pathlib import Path
 
+from repo_manager.commands.rapp import add_rapp_parser
+from repo_manager.commands.rapp import init as rapp_init
+from repo_manager.commands.rapp import pin_image as rapp_pin_image
+from repo_manager.commands.rapp import validate as rapp_validate
+
 
 def main(argv: list[str] | None = None) -> int:
     parser = argparse.ArgumentParser(
@@ -55,6 +59,8 @@ def main(argv: list[str] | None = None) -> int:
         help="Patch file only (invalid as full applied evidence; for tests)",
     )
 
+    add_rapp_parser(sub)
+
     args = parser.parse_args(argv)
 
     if args.version or args.command in (None, "version"):
@@ -123,6 +129,32 @@ def main(argv: list[str] | None = None) -> int:
         print(json.dumps(result.to_dict(), indent=2))
         return 0 if result.status == "applied" else 1
 
+    if args.command == "rapp":
+        if args.rapp_command == "init":
+            result = rapp_init(
+                Path(args.path),
+                app=args.app,
+                ownership_repo=args.ownership_repo,
+                rail=args.rail,
+                classification=args.classification,
+                criticality=args.criticality,
+                package_type=args.package_type,
+                purpose=args.purpose,
+                force=args.force,
+            )
+        elif args.rapp_command == "validate":
+            result = rapp_validate(
+                Path(args.path),
+                family_root=Path(args.family_root) if args.family_root else None,
+            )
+        elif args.rapp_command == "pin-image":
+            result = rapp_pin_image(Path(args.path), args.digest)
+        else:
+            parser.print_help()
+            return 2
+        print(json.dumps(result, indent=2))
+        return 0 if result.get("ok") else 1
+
     parser.print_help()
     return 0