Add an idempotent Bash installer for test environment hosts

[Nickfost]

Goal

Provide a repository-owned Bash installer for persistent or on-demand test environment hosts used for deployed application testing, browser QA, integration validation, and release-candidate verification.

This role is separate from:

• ephemeral CI workers, which execute short isolated test shards; and
• production deployers, which promote approved immutable artifacts into production.

Required interface

Provide a command such as:

sudo ./scripts/install-tester.sh --config /etc/ci-fleet/tester.env

After host-local configuration and approved credentials exist, installation and convergence must require one documented, noninteractive Bash command.

Responsibilities

• verify supported Linux, root privileges, Docker Engine, Compose v2, required generic tools, storage, network, DNS/proxy, and host isolation;
• validate test-host configuration without printing secrets;
• create root-owned configuration and secret directories with enforced permissions;
• install the pinned test-environment controller/service and record its source commit and image digest;
• create, update, reset, inspect, and remove project test environments through a defined interface;
• support multiple projects and multiple isolated test environments without hardcoding project names into the host image;
• enforce unique Compose names, networks, volumes, hostnames, and port/proxy routes;
• install healthcheck, scoped cleanup, expiration, reset, monitoring, upgrade, and rollback systemd units/timers;
• support explicit --check, --install, --upgrade, --reset, --rollback, and --uninstall modes or equivalent;
• produce a concise final report suitable for an operator or automation agent.

Security rules

• Never place test credentials in ci-fleet, application repositories, Git history, images, logs, command arguments, or artifacts.
• Test environments must never receive production credentials, production databases, or production network authority.
• Test and production must use separate identities, secret scopes, networks, storage, domains, and approval policies.
• The tester must consume only explicitly authorized immutable artifacts or image digests.
• Public or untrusted pull requests must not be automatically deployed to internal test infrastructure.
• The installer must not modify application repositories or GitHub environment policies.
• Never use global Docker prune or remove unrelated resources.
• Do not install project runtimes directly on the host.
• Do not combine this service with the shared CI controller or production deployer.

Operational requirements

• Idempotent: rerunning the installer converges safely without duplicate services, environments, routes, timers, or residue.
• Disposable environments: each environment can be recreated from repository-authored configuration and approved artifacts.
• Resettable data: documented commands restore known fixtures without touching unrelated environments.
• Expiring previews: abandoned preview environments are removed through scoped, auditable cleanup.
• Transactional upgrades: validate replacement services and artifacts before switching traffic.
• Rollback-capable: preserve or identify the last known-good tester service and deployed release candidate.
• Observable: report health, deployed digest, source revision, age, ownership, expiration, routes, disk use, and cleanup status.
• Backup-aware: distinguish disposable test data from any fixtures/configuration that require backup.
• Linux-only implementation; no PowerShell or Windows deployment paths.
• Document one-command fresh install, upgrade, repair, validation, reset, rollback, and removal.

Acceptance

On a prepared isolated Linux test host, an operator should only need to:

1. checkout a reviewed ci-fleet/delivery commit;
2. place the host-local configuration and approved test credentials;
3. run one Bash command;
4. receive a verified tester service and an actionable final report.

A second run must make no unnecessary changes. The resulting host must be incapable of production deployment and must not accept ordinary ephemeral CI jobs.

[Nickfost]

[lane-a:phase2:issue-23-outcome]

Repository implementation is clean at draft PR #76 head 7c0e0e34b66d8e0607cc13297c2d2a3cbb92881d: exact-head CI passed, Codex reported no major issues, all 47 findings have evidence replies and +1, and no useful thread remains unresolved.

The issue remains open for separately authorized fresh Debian/Docker host proof covering installation, Docker behavior, health, rollback, and idempotent rerun. No live host was changed.