ci(distribution): prove install claim verify upgrade on a clean host

[teckedd-code2save]

Goal

Turn #93's distribution contract into a repeatable end-to-end acceptance test on a disposable Linux host.

Workflow

Adds .github/workflows/distribution-acceptance.yml.

It runs:

• manually, with an optional image tag
• after successful Build & Deploy runs on main

For automatic runs it first checks whether the distribution surface changed, so unrelated application changes skip the expensive clean-host test.

Acceptance flow

On a fresh GitHub-hosted Linux machine:

1. authenticate root Docker to GHCR
2. verify the canonical installer checksum
3. run scripts/install --json
4. require claim_required with loopback local/claim URLs
5. prove the management port binds only to 127.0.0.1
6. prove the canonical install does not mount /root/.ssh
7. claim the real instance through /api/auth/claim
8. prove the bootstrap claim is consumed
9. run private-mode instance verification
10. require container/storage/host/PTTY/MCP/OAuth/claim checks to be ready
11. verify MCP tool discovery + OAuth resource metadata directly
12. rerun the installer and prove idempotent already_claimed / changed:false
13. run --preview and prove it is non-mutating
14. run a guarded same-image --upgrade
15. require upgrade_complete, DB backup evidence and digest-pinned runtime image
16. prove the authenticated operator session survives the upgrade
17. run --uninstall
18. prove dataPreserved:true and that the DB volume still exists

Evidence

Uploads a 7-day acceptance artifact with:

• install result
• claim result/status
• structured verification
• idempotent rerun
• upgrade preview/result
• uninstall result

Claim token, claim URL and claim path are removed before the artifact is written.

Guardrail

A Vitest file parses the workflow YAML and locks the install → claim → verify → upgrade → uninstall contract so workflow syntax/intent is checked on PRs even though the workflow itself is triggered after deployment.