feat(edp): provision Foundry reader grants

infra/deploy-runner/build-module-foundry-artifact.mjs

@@ -38,6 +38,8 @@ const stage = await mkdtemp(join(tmpdir(), "nodedc-module-foundry-artifact-"));
 const payload = join(stage, "payload");
 const target = join(artifactDir, `nodedc-module-foundry-${patchId}.tgz`);
 
+await assertSourceBoundary();
+
 try {
   await mkdir(payload, { recursive: true });
   for (const sourceRelative of files) {
@@ -60,6 +62,31 @@ try {
   await rm(stage, { recursive: true, force: true });
 }
 
+async function assertSourceBoundary() {
+  const compose = await readFile(resolve(foundryRoot, "infra/docker-compose.module-foundry.yml"), "utf8");
+  for (const fragment of [
+    "source: /volume1/docker/nodedc-platform/secrets/foundry-edp-managed-provisioner/private-key.pem",
+    "target: /run/nodedc-secrets/foundry-edp-managed-provisioner/private-key.pem",
+    "NODEDC_EXTERNAL_DATA_PLANE_FOUNDRY_PROVISIONER_PRIVATE_KEY_FILE: /run/nodedc-secrets/foundry-edp-managed-provisioner/private-key.pem",
+    "create_host_path: false",
+  ]) {
+    if (!compose.includes(fragment)) throw new Error(`foundry_reader_grant_boundary_missing:${fragment}`);
+  }
+  const provisioner = await readFile(resolve(foundryRoot, "server/foundry-reader-grant-provisioner.mjs"), "utf8");
+  for (const marker of [
+    '"/internal/data-plane/v1/consumer-reader-bindings/plan"',
+    "consumer-reader-bindings/by-key/${encodeURIComponent(bindingKey)}",
+    "capabilityDigest: createHash(\"sha256\").update(token",
+    "sourceScope: \"resolved-server-side\"",
+    "O_NOFOLLOW",
+  ]) {
+    if (!provisioner.includes(marker)) throw new Error(`foundry_reader_grant_boundary_missing:${marker}`);
+  }
+  if (/providerId|tenantId|connectionId/.test(provisioner)) {
+    throw new Error("foundry_reader_grant_source_scope_boundary_violation");
+  }
+}
+
 function canonicalTarScript() {
   return [
     "import gzip,io,pathlib,sys,tarfile",
@@ -88,6 +115,7 @@ async function copySafe(source, destination) {
 
   await mkdir(destination, { recursive: true });
   for (const entry of await readdir(source, { withFileTypes: true })) {
+    if (entry.name === "private-key.pem") throw new Error(`private_key_source_rejected:${relative(foundryRoot, join(source, entry.name))}`);
     if (ignoredBasenames.has(entry.name) || entry.name.startsWith(".env") || entry.name.endsWith(".tsbuildinfo")) continue;
     const childSource = join(source, entry.name);
     const childDestination = join(destination, entry.name);