feat(k1): stabilize LAB bridge and isolate onboard device integration

apps/node-agent/packaging/k1_bootstrap.py

@@ -0,0 +1,26 @@
+"""Fixed root-owned import path; no user site, environment path or import hooks."""
+
+import os
+import sys
+from pathlib import Path
+
+root = Path("/var/lib/mission-core-k1-runtime")
+reference = root / "active.path"
+runtime = Path(reference.read_text().strip())
+if (
+    reference.is_symlink()
+    or runtime.is_symlink()
+    or runtime.parent != root
+    or not runtime.name.isalnum()
+    or runtime.stat().st_uid != 0
+    or runtime.stat().st_mode & 0o022
+):
+    raise RuntimeError("Unsafe K1 runtime")
+sys.path[:0] = [
+    str(runtime), str(runtime / "rerun_sdk"),
+    "/usr/lib/mission-core-node/k1/src", "/usr/lib/mission-core-node/sdk",
+]
+os.environ["MISSIONCORE_DATA_DIR"] = "/var/lib/mission-core-k1"
+from k1link.device_plugins.xgrids_k1.node_bridge import main
+
+main()