feat: add rmgr rapp init/validate/pin-image

Prove the user-engine wrapper shape and give Repo Manager a
secret-free scaffolder that refuses invented rails and live-contract
overwrites.

tests/test_rapp_scaffold.py

@@ -0,0 +1,59 @@
+from pathlib import Path
+
+from repo_manager.cli import main
+from repo_manager.commands.rapp import init, pin_image, validate
+
+
+def test_init_refuses_rapp_prefixed_app(tmp_path: Path):
+    result = init(tmp_path / "rapp-x", app="rapp-x", ownership_repo="x")
+    assert result["ok"] is False
+
+
+def test_init_and_validate_draft(tmp_path: Path):
+    dest = tmp_path / "rapp-example"
+    created = init(
+        dest,
+        app="example",
+        ownership_repo="example-app",
+        purpose="Package and operate the example service.",
+    )
+    assert created["ok"] is True
+    assert (dest / "declarations" / "rapp.yaml").is_file()
+    refused = init(dest, app="example", ownership_repo="example-app")
+    assert refused["ok"] is False
+    checked = validate(dest, family_root=tmp_path)
+    # Isolated family root has no rails; validator may warn/error on rail
+    # resolution. The bootstrap files must still be accepted by the local
+    # fallback if the family validator is absent, or produce structured output.
+    assert "path" in checked
+
+
+def test_cli_init_and_pin(tmp_path: Path, capsys):
+    dest = tmp_path / "rapp-user-engine"
+    assert (
+        main(
+            [
+                "rapp",
+                "init",
+                "--path",
+                str(dest),
+                "--app",
+                "user-engine",
+                "--ownership-repo",
+                "user-engine",
+            ]
+        )
+        == 0
+    )
+    (dest / "manifests").mkdir()
+    (dest / "manifests" / "runtime.yaml").write_text(
+        "image: forgejo.coulomb.social/coulomb/user-engine"
+        "@sha256:e3b5f65bafc1c0260dfdf2567a52766e67506ceb878a51759a2e9a307c4b5eb8\n"
+    )
+    digest = "sha256:" + "ab" * 32
+    pinned = pin_image(dest, digest)
+    assert pinned["ok"] is True
+    assert digest in (dest / "manifests" / "runtime.yaml").read_text()
+    assert main(["rapp", "pin-image", "--path", str(dest), "--digest", "latest"]) == 1
+    out = capsys.readouterr().out
+    assert "sha256" in out or "digest" in out