feat(api): expose harbor registry controlled recovery preflight

scripts/reboot-recovery/tests/test_harbor_watchdog_contract.py

@@ -0,0 +1,33 @@
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[3]
+WATCHDOG = ROOT / "scripts/reboot-recovery/harbor-watchdog.sh"
+
+
+def test_harbor_watchdog_exposes_single_run_contracts() -> None:
+    text = WATCHDOG.read_text(encoding="utf-8")
+
+    assert "--check" in text
+    assert "--repair-once" in text
+    assert "AWOOOI_HARBOR_WATCHDOG_CHECK" in text
+    assert "mode=check" in text
+    assert "docker compose up -d harbor-log" in text
+    assert "docker compose up -d" in text
+
+
+def test_harbor_watchdog_does_not_use_incident_grade_actions() -> None:
+    text = WATCHDOG.read_text(encoding="utf-8")
+    forbidden = [
+        "systemctl restart docker",
+        "service docker restart",
+        "\nreboot",
+        "\nsudo reboot",
+        "\nshutdown",
+        "\nsudo shutdown",
+        "docker system prune",
+        "docker volume rm",
+    ]
+
+    for pattern in forbidden:
+        assert pattern not in text