test(deploy): add a gate against invalid master-key defaults

[argszero]

What

docker-compose.yml used to ship:

- ATP_MASTER_KEY=${ATP_MASTER_KEY:-dev-master-key-请替换}

dev-master-key-请替换 is not 64 hex chars, and crypto::parse_master_key requires exactly 32 bytes / 64 hex chars. So Config/Crypto::from_config logged one error and fell through to a random dev master key. Consequence: every restart made already-encrypted upstream keys undecryptable — a silent all-503, with a single startup line as the only trace. The same defect was found the same day in the deployment repo's ci/docker-compose.yml, where it caused a real multi-minute outage.

The convention ("no default, or a valid 64-hex default") lived only in prose, so nothing stopped it recurring. This PR pins it in cargo test.

How

New test-only module src/deploy_gate.rs (#[cfg(test)], registered in src/main.rs; not in release builds). It scans the shipped deployment/config artifacts (docker-compose.yml, config/config.example.toml, Dockerfile, README.md, README.en.md) at compile time (include_str!, so no working-directory dependency) and requires every master-key default to be either absent or exactly 64 hex chars.

Classification is by shape, not by line:

shape	example	verdict
Required	${ATP_MASTER_KEY:?msg}	allowed (fail-loud, no default)
Default	${ATP_MASTER_KEY:-x}	x must be 64 hex
Literal	ATP_MASTER_KEY=x	x must be 64 hex (empty allowed)
NotALiteral	$(openssl rand -hex 32) / ${VAR}	skipped — not a default value

A comment is not a default, and a valid 64-hex default stays allowed. The file's own quick-start comment block contains ATP_MASTER_KEY=$(openssl rand -hex 32), which the classifier correctly skips.

Tests

cargo test 246 → 249 passed, 0 failed (cargo fmt --check clean; clippy reports only the pre-existing local-toolchain collapsible_match at src/protocol.rs:662, which is green in CI on the same code).

Three new tests:

• no_master_key_default_that_is_not_valid_hex — the invariant.
• the_scanner_actually_finds_the_settings_it_guards — positive control: compose must contain exactly one Required setting, no literal default, and the scanner must actually see the quick-start comments (otherwise "invisible" and "compliant" are indistinguishable).
• classifier_and_config_parser_flag_the_pre_fix_shapes — synthetic-input control on the classifier/parser themselves.

A/B (teeth verification)

Snapshots taken in memory and restored byte-for-byte (no git checkout):

leg	input	result
M1	compose line → ${ATP_MASTER_KEY:-dev-master-key-请替换} (the pre-fix shape)	RED — 默认值不是 64 位 hex
M2	compose line → bare ATP_MASTER_KEY=dev-master-key-请替换 (Literal branch)	RED — 字面量主密钥不是 64 位 hex
M3	config.example.toml example → not-a-hex-value (config branch)	RED — master_key 示例值不是 64 位 hex
live	unmodified tree	GREEN 3/3

One self-caught instrumentation error worth recording: the first M2 attempt was a no-op (the replacement string did not match, so the measured file never moved) and reported GREEN — a false "the gate has no teeth" reading. Redone with an explicit mutated != orig assertion; only then did it go red.

Notes

• Does not change docker-compose.yml (already fixed in fix(deploy): require ATP_MASTER_KEY in docker-compose instead of defaulting to an invalid value #235) — this is the gate that keeps it fixed.
• The docker compose config validation hinted at in the work order is not reproducible in this environment (docker: command not found); marked pending rather than claimed.