fix(device-edge): reconcile runtime modes safely

infra/deploy-runner/build-device-edge-vps-artifact.mjs

@@ -29,11 +29,17 @@ const runtimeCache = resolve(
 const [phase, patchId, ...extra] = process.argv.slice(2);
 if (
   extra.length
-  || !["foundation", "backhaul", "relay", "core-channel"].includes(phase)
+  || ![
+    "foundation",
+    "runtime-reconciliation",
+    "backhaul",
+    "relay",
+    "core-channel",
+  ].includes(phase)
   || !/^[A-Za-z0-9._-]{1,96}$/.test(patchId || "")
 ) {
   throw new Error(
-    "usage: build-device-edge-vps-artifact.mjs <foundation|backhaul|relay|core-channel> <patch-id>",
+    "usage: build-device-edge-vps-artifact.mjs <foundation|runtime-reconciliation|backhaul|relay|core-channel> <patch-id>",
   );
 }
 
@@ -61,6 +67,9 @@ const entriesByPhase = {
     `vendor/${nodeArchive}`,
     `vendor/${tailscaleArchive}`,
   ],
+  "runtime-reconciliation": [
+    "deployment/device-edge-vps-runtime-reconciliation-v1.json",
+  ],
   backhaul: [
     "vps/config/backhaul_ssh_config",
     "vps/systemd/nodedc-b2-backhaul.service",
@@ -205,6 +214,18 @@ async function assertBoundary() {
       throw new Error("foundation_must_not_open_9921");
     }
   }
+  if (phase === "runtime-reconciliation") {
+    for (const required of [
+      "recover-exact-runtime-executable-modes-after-failed-core-channel-publish",
+      "restore-root-owned-executable-mode-0755-for-exact-known-binaries",
+      '"publicCoreChannel": "disabled"',
+      '"trackerIngress": "disabled"',
+    ]) {
+      if (!combined.includes(required)) {
+        throw new Error(`runtime_reconciliation_boundary_missing:${required}`);
+      }
+    }
+  }
   if (phase === "backhaul") {
     for (const required of [
       "\"runtimeUser\": \"nodedc-backhaul\"",