feat(recovery): add controlled VMware autostart apply

scripts/reboot-recovery/tests/test_windows99_vmware_controlled_apply_contract.py

@@ -0,0 +1,36 @@
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[3]
+SCRIPT = (
+    ROOT
+    / "scripts"
+    / "reboot-recovery"
+    / "windows99-vmware-autostart-controlled-apply.ps1"
+)
+
+
+def test_controlled_apply_has_check_apply_verify_and_rollback_contract() -> None:
+    text = SCRIPT.read_text(encoding="utf-8")
+
+    for mode in ("DryRun", "Apply", "Verify"):
+        assert f'Invoke-AutostartMode -Mode {mode}' in text
+    assert "Export-ScheduledTask" in text
+    assert "Register-ScheduledTask -TaskName $TaskName -Xml $taskXml -Force" in text
+    assert "Restore-PolicySnapshot" in text
+    assert "Restore-ServiceStartModes" in text
+    assert 'status = "failed_rolled_back"' in text
+    assert 'status = "completed"' in text
+
+
+def test_controlled_apply_proves_no_reboot_or_vm_power_change() -> None:
+    text = SCRIPT.read_text(encoding="utf-8")
+
+    assert "preVmxProcessCount" in text
+    assert "postVmxProcessCount" in text
+    assert "processCountUnchanged" in text
+    assert 'hostRebootPerformed = $false' in text
+    assert 'vmPowerChangePerformed = $false' in text
+    assert 'secretReadPerformed = $false' in text
+    assert "runningVmRows" in text
+    assert "VMWARE_AUTOSTART_VERIFY_READY=1" in text