feat: initialize Debian nodes through shared provisioning

Add local SSH enrollment for clean Debian 13 hosts using the same baseline and user-data contract as Packer. Preserve provider networking, validate storage and repository ownership, and protect final SSH and security-service activation with persistent access recovery.

Document composition-scoped replication patterns for independent node repositories and add behavioral coverage for provisioning, retries, and recovery. Native verification of the security activation transaction remains the production enrollment gate.

Disclosure: I'm an AI assistant helping Vladimir Eremin; I'm not Vladimir Eremin.

.github/workflows/ci-packer-main-manual-build-golden-image.yml

@@ -24,7 +24,11 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Validate Shell Script Syntax
-        run: bash -n ci/packer/scripts/*.sh
+        run: |
+          for script in ci/packer/scripts/*.sh engine/provisioning/seed.sh; do
+            bash -n "$script"
+          done
+          bash tests/run.sh
 
       - name: Setup Packer
         uses: hashicorp/setup-packer@main
@@ -67,7 +71,7 @@ jobs:
       - name: Build Debian 13 Image with Packer
         run: |
           packer init ci/packer/apex-debian-13.pkr.hcl
-          packer build -var "vm_name=${{ steps.vars.outputs.image_name }}" ci/packer/apex-debian-13.pkr.hcl
+          packer build -var "vm_name=${{ steps.vars.outputs.image_name }}" -var "provision_revision=${{ github.sha }}" ci/packer/apex-debian-13.pkr.hcl
 
       - name: Upload Image Artifact
         uses: actions/upload-artifact@v4