fix(deploy): support bootstrap password rotation

scripts/local-vector-smoke.sh

@@ -195,8 +195,43 @@ fi
 compose up --force-recreate --no-deps --wait core
 probe_vector read
 
+old_bootstrap_password=$(cat "$secret_dir/bootstrap")
+printf '%s' "wrong-bootstrap-${smoke_project}" >"$secret_dir/bootstrap-wrong"
+printf '%s' "next-bootstrap-'quoted-${smoke_project}" >"$secret_dir/bootstrap-next"
+cp "$secret_dir/bootstrap" "$secret_dir/bootstrap-before-negative"
+if COMPOSE_PROJECT_NAME="$smoke_project" \
+    ./scripts/vector-rotate-bootstrap-password.sh \
+    "$secret_dir/bootstrap-wrong" "$secret_dir/bootstrap-next" \
+    >/dev/null 2>&1; then
+  echo "bootstrap rotation accepted the wrong old secret" >&2
+  exit 1
+fi
+cmp "$secret_dir/bootstrap" "$secret_dir/bootstrap-before-negative"
+
+COMPOSE_PROJECT_NAME="$smoke_project" \
+  ./scripts/vector-rotate-bootstrap-password.sh \
+  "$secret_dir/bootstrap" "$secret_dir/bootstrap-next"
+new_bootstrap_password=$(cat "$secret_dir/bootstrap")
+test "$new_bootstrap_password" != "$old_bootstrap_password"
+if compose run --rm --no-deps --entrypoint psql \
+    -e PGPASSWORD="$old_bootstrap_password" vector-reconcile \
+    --host vector-db --username postgres --dbname thoth --command 'SELECT 1' \
+    >/dev/null 2>&1; then
+  echo "old bootstrap credential still works after rotation" >&2
+  exit 1
+fi
+compose run --rm --no-deps --entrypoint psql \
+  -e PGPASSWORD="$new_bootstrap_password" vector-reconcile \
+  --host vector-db --username postgres --dbname thoth --command 'SELECT 1' \
+  >/dev/null
+compose run --rm vector-reconcile
+bootstrap_rotation_status=$(compose run --rm --no-deps vector-migrate)
+printf '%s\n' "$bootstrap_rotation_status" | grep -q '"pending": \[\]'
+compose up --force-recreate --no-deps --wait core
+probe_vector read
+
 compose restart vector-db core
 compose up --wait vector-db core
 probe_vector read
 
-echo "Local pgvector migration, credential rotation, least-privilege roles, and persistence passed."
+echo "Local pgvector runtime/bootstrap rotation, least-privilege roles, and persistence passed."