[lweberru]

Summary

Replace the blanket Firewall/HA Apply block with an explicit, protected execution contract, and remove avoidable Runner initialization work.

• Add optional OPNsense administrator credentials to personal credential profiles. Values remain in the owner-/tenant-bound secret store; migration 059 adds only a non-secret capability flag.
• Require HA administration capability before preparation, bind it to the immutable profile/version/source manifest, and revalidate it at broker handoff. Existing HA Plans cannot acquire credentials retroactively.
• Allow authorized Firewall/HA infrastructure Apply using the exact reviewed saved artifact. Preserve revision, state, organization, role and explicit approval checks.
• Pass appliance administration through child-process environment variables only and redact it from Runner output. Firewall policy/API-key bootstrap and VPN PSKs remain explicitly unsupported rather than silently omitted.
• Omit the 993,525,760-byte image from non-Firewall workspaces, attempt copy-on-write materialization with a safe copy fallback, prepare an immutable unpacked provider mirror with readonly-lock verification, and emit fixed-label startup phase timings through authenticated job output.
• Update credential, execution, user and Runner documentation in English and German. Regenerate documentation provenance without changing any of the 19 curated Assistant topics or proposal permissions.

Verification

• GitHub CI on 8d685a2: 9 successful, 4 intentionally skipped by Accelerator change scope, zero failures. The Configurator application and all six operator OpenTofu checks passed. Native Accelerator sources were not changed.
• Canonical npm run check: provenance, lint, complete typecheck, production build, 860 passed / 69 environment-gated skips.
• All 69 gated cases were covered separately: 61 platform broker/database cases, 7 real Linux Runner/package cases within the 136/136 affected-suite run, and the native backend case within 27/27 backend tests.
• Full PostgreSQL migration/RLS/identity integration: 54/54, including owner isolation, metadata-only storage and failure when HA secret capability disappears.
• Complete desktop/mobile Playwright suite: 312/312 against synthetic API contracts.
• Native OpenTofu variable contracts: 13/13.
• Release/image/artifact/environment contracts: 28/28.
• Native HA scripts run against authenticated local appliance fixtures for primary and backup CARP/pfsync/XMLRPC, plus unauthorized and unsupported-appliance failures.
• All eight actual pinned Linux providers initialize offline with unchanged readonly locks. Local warm-cache median init: 2.391 s packed → 0.286 s unpacked; expanded mirror storage increases by 263,440,768 bytes.

Operational boundaries

• No deployment, cloud Apply, customer-state operation or real HA/failover qualification was performed. A local contract test is not a reachability or failover certificate.
• The hosted approximately one-minute startup delay has not been measured end-to-end. CF scheduling/droplet setup, image verification and copy fallback remain; the new timings make subsequent hosted diagnosis possible.
• Existing HA configurations/evidence are retained. After release, create an administration-enabled credential profile and a new preparation/Plan before explicit Apply approval.
• This source change is not deployment approval. Release/provisioning remain manual, including the exact-source qualification gates.

[lweberru]

Superseded by merged #119, which includes all changes from this PR together with the one-shot warm Runner pool. Dev deployment remains a separate explicitly authorized manual release; no customer Apply or production deployment is included.