feat: publish Tend v0.2 preview source

Publish the reviewed allowlisted snapshot whose exact binary completed maintenance deployment, rollback, and reactivation exercises for Gamertan and Sandwich Hime.

Private-Source-Commit: 4d7094c8b7c61991bfb67b11fc1558724c874eb2

Private-Source-Tree: 54a2f74804f7acddf3755d7d4da5b97f5fc28381

AI-Assistance: OpenAI Codex assisted implementation, testing, security review, and release verification.
Signed-off-by: Cole Speelman <crspeelman@gmail.com>

internal/serverpolicy/policy_test.go

@@ -0,0 +1,59 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+
+package serverpolicy
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestParseAcceptsStrictServiceMap(t *testing.T) {
+	body := `{"schema_version":1,"config_root":"/etc/tend/services","incoming_root":"/var/lib/tend/incoming","shared_lock_file":"/run/lock/tend-deploy.lock","services":{"example-site":{"config":"/etc/tend/services/example-site.json","max_artifact_bytes":1048576}}}`
+	policy, err := Parse(strings.NewReader(body))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if policy.Services["example-site"].MaxArtifactBytes != 1<<20 {
+		t.Fatalf("policy=%+v", policy)
+	}
+}
+
+func TestRejectEnvironmentKeyProtectsSingletonCandidateOverride(t *testing.T) {
+	directory := t.TempDir()
+	path := filepath.Join(directory, "service.env")
+	for _, test := range []struct {
+		name    string
+		body    string
+		wantErr bool
+	}{
+		{name: "shared values only", body: "APP_SECRET=private\n"},
+		{name: "exact listen key", body: "EXAMPLE_LISTEN=127.0.0.1:8092\n", wantErr: true},
+		{name: "spaced listen key", body: "  EXAMPLE_LISTEN = 127.0.0.1:8092\n", wantErr: true},
+		{name: "commented listen key", body: "# EXAMPLE_LISTEN=127.0.0.1:8092\n"},
+		{name: "longer key", body: "EXAMPLE_LISTENER=safe\n"},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			if err := os.WriteFile(path, []byte(test.body), 0o600); err != nil {
+				t.Fatal(err)
+			}
+			err := rejectEnvironmentKey(path, "EXAMPLE_LISTEN")
+			if (err != nil) != test.wantErr {
+				t.Fatalf("error=%v wantErr=%v", err, test.wantErr)
+			}
+		})
+	}
+}
+
+func TestParseRejectsUnknownAndForgedPaths(t *testing.T) {
+	tests := []string{
+		`{"schema_version":1,"config_root":"/etc/tend/services","incoming_root":"/var/lib/tend/incoming","shared_lock_file":"/run/lock/tend-deploy.lock","services":{"example-site":{"config":"/tmp/example.json","max_artifact_bytes":1048576}}}`,
+		`{"schema_version":1,"config_root":"/etc/tend/services","incoming_root":"/var/lib/tend/incoming","shared_lock_file":"/run/lock/tend-deploy.lock","services":{},"surprise":true}`,
+	}
+	for _, body := range tests {
+		if _, err := Parse(strings.NewReader(body)); err == nil {
+			t.Fatalf("accepted %s", body)
+		}
+	}
+}