feat: complete Epic 1 production foundation

tests/unit/test_check_runtime_config.py

@@ -100,6 +100,38 @@ class RuntimeConfigContractTests(unittest.TestCase):
         result = self.run_check(root)
         self.assertNotEqual(result.returncode, 0)
 
+    def test_deprecated_startup_bootstrap_password_may_be_absent_from_compose(self) -> None:
+        root = self.fixture()
+        schema_path = root / "docs/schemas/runtime-config.schema.json"
+        schema = json.loads(schema_path.read_text(encoding="utf-8"))
+        schema["fields"].append(
+            {
+                "env_name": "CRANK_BOOTSTRAP_ADMIN_PASSWORD",
+                "process": "admin_api",
+                "mode": "effective",
+                "required": False,
+                "default": None,
+                "sensitivity": "secret",
+                "compatibility": "deprecated startup-bootstrap password; use local bootstrap contract",
+            }
+        )
+        schema_path.write_text(json.dumps(schema), encoding="utf-8")
+        for relative in (
+            ".env.example",
+            "deploy/community/.env.example",
+            "deploy/community/.env.images.example",
+        ):
+            path = root / relative
+            path.write_text(
+                path.read_text().replace(
+                    "CRANK_SHARED=value\n",
+                    "CRANK_SHARED=value\nCRANK_BOOTSTRAP_ADMIN_PASSWORD=\n",
+                ),
+                encoding="utf-8",
+            )
+        result = self.run_check(root)
+        self.assertEqual(result.returncode, 0, result.stderr)
+
     def test_divergent_inline_default_fails(self) -> None:
         root = self.fixture()
         path = root / "docker-compose.yml"