Add enterprise appliance experience Phase 1 foundation

tests/deployment/README.md

@@ -0,0 +1,18 @@
+# Deployment Validation
+
+Run from the repository root on a safe validation host.
+
+```bash
+bash -n install.sh autoinstall/firstboot-setup.sh autoinstall/build-iso.sh \
+  autoinstall/build-iso-workstation.sh autoinstall/build-iso-starter.sh
+ansible-playbook --syntax-check ansible/starter.yml
+ansible-playbook --syntax-check ansible/entry.yml
+ansible-playbook --syntax-check ansible/pro.yml
+ansible-playbook --syntax-check ansible/max.yml
+python3 -m py_compile ansible/roles/cezen-backend/files/main.py \
+  ansible/roles/cezen-backend/files/cezen_license.py autoinstall/websetup/server.py
+```
+
+Syntax checks do not prove installation. Phase 1 additionally requires clean-install, interruption,
+reboot/resume, restricted-network, migration, backup/restore and source-to-artifact evidence on one
+representative Workstation and one representative Server.

tests/deployment/test_firstboot_setup.py

@@ -0,0 +1,21 @@
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[2]
+FIRSTBOOT = ROOT / "autoinstall/firstboot-setup.sh"
+
+
+def test_console_setup_preserves_workstation_separation_and_safe_completion():
+    source = FIRSTBOOT.read_text()
+    assert 'WORKSTATION_MODE' in source
+    assert 'TIER_DISPLAY="workstation"' in source
+    assert 'touch /opt/cezen/.setup-done' in source
+    assert source.index('touch /opt/cezen/.setup-done') > source.index('if bash "$AIPACKAGE_DIR/install.sh"')
+
+
+def test_console_setup_has_resume_and_recovery_contract():
+    source = FIRSTBOOT.read_text()
+    # Intentionally red until T028 adds durable console progress.
+    assert "cezen.setup_operation.v1" in source
+    assert "recovery_required" in source
+    assert "resume" in source.lower()