fix(deploy): align vector bootstrap identity policy

scripts/test-vector-bootstrap-rotation.sh

@@ -10,7 +10,7 @@ log="$tmp/docker.log"
 cat >"$fake" <<'SH'
 #!/bin/sh
 set -eu
-printf '%s\n' "$*" >>"$FAKE_DOCKER_LOG"
+printf '%s:%s\n' "${THT_VECTOR_BOOTSTRAP_USER:-unset}" "$*" >>"$FAKE_DOCKER_LOG"
 exit "${FAKE_DOCKER_EXIT:-0}"
 SH
 chmod 0755 "$fake"
@@ -19,6 +19,21 @@ printf '%s' old-password >"$tmp/old"
 printf '%s' "new-'quoted-\$-password" >"$tmp/new"
 cp "$tmp/old" "$tmp/original"
 
+printf 'invalid password\n' >"$tmp/whitespace"
+: >"$log"
+if PATH="$tmp:$PATH" FAKE_DOCKER_LOG="$log" THT_VECTOR_BOOTSTRAP_USER=custom_admin \
+    ./scripts/vector-rotate-bootstrap-password.sh "$tmp/old" "$tmp/whitespace" \
+    >"$tmp/out" 2>"$tmp/err"; then
+  echo "rotation accepted a whitespace-containing secret" >&2
+  exit 1
+fi
+cmp "$tmp/old" "$tmp/original"
+test ! -s "$log"
+if find "$tmp" -name 'old.rotate.*' -print | grep -q .; then
+  echo "rotation staged a deployment file before secret validation" >&2
+  exit 1
+fi
+
 if PATH="$tmp:$PATH" FAKE_DOCKER_LOG="$log" FAKE_DOCKER_EXIT=1 \
     ./scripts/vector-rotate-bootstrap-password.sh "$tmp/old" "$tmp/new" \
     >"$tmp/out" 2>"$tmp/err"; then
@@ -28,12 +43,13 @@ fi
 cmp "$tmp/old" "$tmp/original"
 
 : >"$log"
-PATH="$tmp:$PATH" FAKE_DOCKER_LOG="$log" \
+PATH="$tmp:$PATH" FAKE_DOCKER_LOG="$log" THT_VECTOR_BOOTSTRAP_USER=custom_admin \
   ./scripts/vector-rotate-bootstrap-password.sh "$tmp/old" "$tmp/new" \
   >"$tmp/out" 2>"$tmp/err"
 cmp "$tmp/old" "$tmp/new"
 grep -q '/run/secrets/bootstrap-old:ro' "$log"
 grep -q '/run/secrets/bootstrap-new:ro' "$log"
+grep -q '^custom_admin:' "$log"
 grep -q 'atomically replaced only after verified database login' "$tmp/out"
 
 echo "bootstrap rotation ordering and no-config-change failure contracts passed."