feat: publish Gamertan Tend preview source

Sanitized root snapshot from private source commit a72903c63e1753f9e6ffbf40453c0830bdfc05c5 and tree 295641e67eef5979da76746d8ae271249568263e. Private development history and workflows are excluded by the exact allowlist.

AI-assisted: OpenAI Codex helped implement, test, and audit this preview.
Signed-off-by: Cole Speelman <crspeelman@gmail.com>

internal/deploy/operator_test.go

@@ -0,0 +1,45 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+
+package deploy
+
+import (
+	"context"
+	"reflect"
+	"testing"
+)
+
+type recordingRunner struct {
+	name string
+	args []string
+}
+
+func (r *recordingRunner) Run(_ context.Context, _ string, _ map[string]string, name string, args ...string) ([]byte, error) {
+	r.name = name
+	r.args = append([]string(nil), args...)
+	return nil, nil
+}
+
+func TestStartCandidateUsesArgumentVectorAndHardenedUnit(t *testing.T) {
+	runner := &recordingRunner{}
+	operator := SystemOperator{Runner: runner}
+	env := map[string]string{"Z_ENV": "safe value", "A_ENV": "first"}
+	if err := operator.StartCandidate(context.Background(), "example-tend-candidate.service", "/opt/example/releases/sha256-a/app", env); err != nil {
+		t.Fatal(err)
+	}
+	if runner.name != "systemd-run" {
+		t.Fatalf("command=%q", runner.name)
+	}
+	required := []string{"--property=DynamicUser=yes", "--property=NoNewPrivileges=yes", "--property=ProtectSystem=strict", "--property=MemoryDenyWriteExecute=yes", "--property=CapabilityBoundingSet=", "--setenv", "A_ENV=first", "--setenv", "Z_ENV=safe value", "--", "/opt/example/releases/sha256-a/app"}
+	cursor := 0
+	for _, arg := range runner.args {
+		if cursor < len(required) && arg == required[cursor] {
+			cursor++
+		}
+	}
+	if cursor != len(required) {
+		t.Fatalf("arguments omitted ordered security boundary: %#v", runner.args)
+	}
+	if reflect.DeepEqual(runner.args, []string{"sh", "-c"}) {
+		t.Fatal("candidate command used a shell")
+	}
+}