feat(deploy): safely initialize the production environment

[SmithLabsLLC]

Summary

• add ./run.sh init <domain> <owner-pubkey-hex>
• generate stable URL-safe deployment secrets without printing them
• create .env with mode 600 and atomic no-overwrite behavior
• validate the public domain and existing owner public key
• add an isolated initialization contract test to CI

Why

The production quick start currently asks operators to copy .env.example and
replace every placeholder manually. Missing a placeholder, using
URL-unsafe database credentials, leaving broad file permissions, or
accidentally overwriting stable secrets can break or weaken a deployment.

Safety

The initializer uses .env.example as the non-secret source template, runs
under umask 077, generates secrets with OpenSSL, and atomically links a
completed owner-only temporary file into place. It refuses an existing file,
symlink, or creation race and never generates or rotates the owner's identity.

Testing

• shellcheck deploy/compose/run.sh deploy/compose/test-init.sh
• bash -n deploy/compose/run.sh deploy/compose/test-init.sh
• deploy/compose/test-init.sh
• initialize a disposable environment and render the real Compose model
• parse the updated CI workflow and verify .env.init.* is ignored
• git diff --check

The contract covers successful generation, normalized inputs, every generated
field shape, removal of assignment placeholders, mode 600, content-preserving
overwrite refusal, invalid domain and public-key rejection, and symlink
refusal. It also keeps the missing-.env instructions tied to the initializer
and verifies that successful initialization prints only the fixed completion
message.

Review

One Fable 5 xhigh review initially returned NEEDS CHANGES. All accepted and
approved findings were incorporated: the missing-.env error and validation
walkthrough use the new command, the manual fallback creates mode-600 output
before editing, and orphaned .env.init.* files are ignored. No second
independent review was run.

Scope

This creates a local configuration file only. It does not start Docker,
deploy Buzz, read a real secret file, generate an owner private key, or rotate
existing credentials.