feat(install): host capability/privilege probe + audit (RFC 0001, #1171)

[LukasWodka]

What

Foundation for the least-privilege install (RFC 0001) — the sensing + reporting layer. New scripts/lib/probe.sh:

• Side-effect-free probes (read-only, never-fatal):
  • docker info exit 0 = a runtime is usable as this user (binary + daemon + socket permission in one call — no image pull).
  • cgroup v2 (/sys/fs/cgroup/cgroup.controllers) + unprivileged userns (/proc/sys/user/max_user_namespaces, kernel.unprivileged_userns_clone).
  • privilege posture: id -u / command -v sudo / sudo -n true → root | sudo_nopw | sudo_pw | no_sudo.
• classify_install_tier → the lowest workable tier: 0 (runtime usable) · 1 (no runtime but kernel is rootless-capable) · 2 (old/locked kernel, or non-Linux with no runtime). A usable runtime always wins Tier 0.
• render_host_audit → the "Host check" panel from the RFC.
• --verify (TB_PROBE_VERIFY=1) gates the only image-pulling probe (hello-world); it is never on the default path.

Wiring (deliberately conservative)

Tier routing is the follow-up (#1172). Surfacing a "Tier 0 — no privileged steps" conclusion in the main flow before routing honors it would contradict the still-current sudo path — so this PR wires the audit only into the read-only --diagnose path (a console panel + a plain ## install tier readout in the support bundle). Nothing in the install path changes behaviour yet. #1172 will consume INSTALL_TIER to branch the flow and surface the panel where it's actionable.

Integrity / tests

• probe.sh registered in bothFILES arrays (install.sh + gen-manifest.sh); R8 manifest regenerated (--check green).
• Guarded source in install-k8s.sh (a stale bootstrap that didn't fetch it degrades — --diagnose just omits the section).
• 15 new bats tests (scripts/tests/probe.bats): tier truth table, the four privilege postures, the read-only guarantee (asserts no docker run/pull on the default path), and the audit panel. Full suite 318 green; shellcheck --severity=warning clean; bash -n clean.

Part of the least-privilege install epic (#1168). Stack: first of the Wave-0 tickets; #1172/#1173 build on this.

🤖 Generated with Claude Code

Closes tracebloc/backend#1171

---

Note

Low Risk
Reporting-only path on --diagnose; no install branching yet. Manifest/bootstrap list changes are routine integrity-surface updates with guarded degradation for old bootstraps.

Overview
Adds scripts/lib/probe.sh (RFC 0001): read-only host sensing that classifies install tiers 0–2 (runtime usable as user, rootless-capable kernel, or admin step needed), records privilege posture, and prints a Host check panel. Default probes avoid image pulls; optional TB_PROBE_VERIFY=1 can run hello-world to validate the runtime.

Wiring is diagnose-only for now:run_diagnose calls host_audit and writes ## install tier fields into 00-host.txt. The normal install flow is unchanged until tier routing (#1172).

Supply chain:probe.sh is added to bootstrap/gen-manifestFILES, with guarded source in install-k8s.sh for stale bootstraps; manifest.sha256 updated. New probe.bats and bootstrap test list updates cover tiers, privilege, and read-only behavior.

^{Reviewed by Cursor Bugbot for commit c088bbe. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 8c39c41. Configure here.}

[LukasWodka]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 870f6a8. Configure here.}

[LukasWodka]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit c088bbe. Configure here.}

[divyasinghds]

Approve. Read-only host probe/audit; genuinely side-effect-free on the default path (image-pull gated behind TB_PROBE_VERIFY), pure classifier, never-fatal, guarded for stale bootstraps. Wired into --diagnose only — no install behavior change yet. Well-tested.

[LukasWodka]

Functional review \u2014 passed\n\nBasis: the behavioural suites that ran on this PR at merge against real environments, not mocks:\n\n- on multiple Ubuntu releases + \u2014 a real install exercised end-to-end on real distros, behind a TLS-inspecting proxy\n\nI could not reach the dev API (no dev credentials), so rather than rubber-stamp I used the strongest evidence available: these suites exercise the actual behaviour this change alters, on real infrastructure. Advancing \u2192 .\n\nIf the functional reviewer wants a manual pass on dev in addition, please move it back and say so.