Полный production-фикс fix30/fix30.1: auth, smoke, bootstrap, preflight, rollback и валидация PATCH

orchestrator/src/platform/assert.ts

@@ -5,6 +5,9 @@ type AssertPlatformOptions = {
   distro: "debian";
   supportedVersions: number[];
   architectures: Array<"amd64">;
+  requireSystemdRun?: boolean;
+  requireNftables?: boolean;
+  requireOpenSsl3?: boolean;
 };
 
 export async function assertPlatform(options: AssertPlatformOptions): Promise<void> {
@@ -29,16 +32,16 @@ export async function assertPlatform(options: AssertPlatformOptions): Promise<vo
       `required capability missing: systemd (${profile.capabilityDetails.systemdReason}; pid1=${profile.capabilityDetails.pid1}; state=${profile.capabilityDetails.systemdState})`
     );
   }
-  if (!profile.capabilities.systemdRun) {
+  if (options.requireSystemdRun !== false && !profile.capabilities.systemdRun) {
     fail("required capability missing: systemd-run");
   }
-  if (!profile.capabilities.nftables) {
+  if (options.requireNftables !== false && !profile.capabilities.nftables) {
     fail("required capability missing: nft");
   }
-  if (!profile.capabilities.nftAtomicReplace) {
+  if (options.requireNftables !== false && !profile.capabilities.nftAtomicReplace) {
     fail("required capability missing: nft atomic replace");
   }
-  if (!profile.capabilities.openssl3) {
+  if (options.requireOpenSsl3 !== false && !profile.capabilities.openssl3) {
     fail("required capability missing: OpenSSL 3.x runtime");
   }
 }