fix(deploy): support bootstrap password rotation

scripts/test-vector-bootstrap-rotation.sh

@@ -0,0 +1,39 @@
+#!/bin/sh
+set -eu
+
+cd "$(dirname "$0")/.."
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' EXIT HUP INT TERM
+
+fake="$tmp/docker"
+log="$tmp/docker.log"
+cat >"$fake" <<'SH'
+#!/bin/sh
+set -eu
+printf '%s\n' "$*" >>"$FAKE_DOCKER_LOG"
+exit "${FAKE_DOCKER_EXIT:-0}"
+SH
+chmod 0755 "$fake"
+
+printf '%s' old-password >"$tmp/old"
+printf '%s' "new-'quoted-\$-password" >"$tmp/new"
+cp "$tmp/old" "$tmp/original"
+
+if PATH="$tmp:$PATH" FAKE_DOCKER_LOG="$log" FAKE_DOCKER_EXIT=1 \
+    ./scripts/vector-rotate-bootstrap-password.sh "$tmp/old" "$tmp/new" \
+    >"$tmp/out" 2>"$tmp/err"; then
+  echo "rotation unexpectedly succeeded when database verification failed" >&2
+  exit 1
+fi
+cmp "$tmp/old" "$tmp/original"
+
+: >"$log"
+PATH="$tmp:$PATH" FAKE_DOCKER_LOG="$log" \
+  ./scripts/vector-rotate-bootstrap-password.sh "$tmp/old" "$tmp/new" \
+  >"$tmp/out" 2>"$tmp/err"
+cmp "$tmp/old" "$tmp/new"
+grep -q '/run/secrets/bootstrap-old:ro' "$log"
+grep -q '/run/secrets/bootstrap-new:ro' "$log"
+grep -q 'atomically replaced only after verified database login' "$tmp/out"
+
+echo "bootstrap rotation ordering and no-config-change failure contracts passed."