fix(recovery): bound cold-start monitor probes

scripts/reboot-recovery/tests/test_cold_start_monitor_bounded_probes.py

@@ -0,0 +1,47 @@
+from __future__ import annotations
+
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[3]
+COLD_START_CHECK = ROOT / "scripts" / "reboot-recovery" / "full-stack-cold-start-check.sh"
+RECOVERY_SCORECARD = (
+    ROOT / "scripts" / "reboot-recovery" / "full-stack-recovery-scorecard.sh"
+)
+VERIFY_DEPLOY = ROOT / "scripts" / "reboot-recovery" / "verify-cold-start-monitor-deploy.sh"
+
+
+def test_full_stack_cold_start_check_bounds_ssh_probes() -> None:
+    text = COLD_START_CHECK.read_text(encoding="utf-8")
+
+    assert 'SSH_COMMAND_TIMEOUT_SECONDS="${SSH_COMMAND_TIMEOUT_SECONDS:-45}"' in text
+    assert "-o ConnectionAttempts=1" in text
+    assert "-o ServerAliveInterval=5" in text
+    assert "-o ServerAliveCountMax=1" in text
+    assert "timeout ${SSH_COMMAND_TIMEOUT_SECONDS}s bash -lc" in text
+    assert "printf -v quoted_cmd '%q' \"$cmd\"" in text
+
+
+def test_recovery_scorecard_bounds_offsite_evidence_ssh() -> None:
+    text = RECOVERY_SCORECARD.read_text(encoding="utf-8")
+
+    assert 'REMOTE_COMMAND_TIMEOUT_SECONDS="${REMOTE_COMMAND_TIMEOUT_SECONDS:-45}"' in text
+    assert "-o ConnectionAttempts=1" in text
+    assert "-o ServerAliveInterval=5" in text
+    assert "-o ServerAliveCountMax=1" in text
+    assert "remote_110_read()" in text
+    assert "timeout ${REMOTE_COMMAND_TIMEOUT_SECONDS}s bash -lc" in text
+    assert "offsite-escrow-evidence-report.sh --no-color" in text
+
+
+def test_cold_start_deploy_parity_verifier_bounds_ssh_readback() -> None:
+    text = VERIFY_DEPLOY.read_text(encoding="utf-8")
+
+    assert 'REMOTE_COMMAND_TIMEOUT_SECONDS="${REMOTE_COMMAND_TIMEOUT_SECONDS:-45}"' in text
+    assert "-o ConnectionAttempts=1" in text
+    assert "-o ServerAliveInterval=5" in text
+    assert "-o ServerAliveCountMax=1" in text
+    assert "remote_read()" in text
+    assert "timeout ${REMOTE_COMMAND_TIMEOUT_SECONDS}s bash -lc" in text
+    assert 'remote_read "sha256sum' in text
+    assert 'if remote_read "grep -Fq' in text