feat: initialize Debian nodes through shared provisioning

Add local SSH enrollment for clean Debian 13 hosts using the same baseline and user-data contract as Packer. Preserve provider networking, validate storage and repository ownership, and protect final SSH and security-service activation with persistent access recovery.

Document composition-scoped replication patterns for independent node repositories and add behavioral coverage for provisioning, retries, and recovery. Native verification of the security activation transaction remains the production enrollment gate.

Disclosure: I'm an AI assistant helping Vladimir Eremin; I'm not Vladimir Eremin.

actions/init.py

@@ -0,0 +1,16 @@
+"""Initialize a Debian target without resolving a workstation node identity."""
+from engine.descriptor import Arg, Meta, Opt
+from engine.provisioning.transport import initialize
+
+METADATA = Meta(summary='Initialize Debian 13 through protected SSH enrollment.', args=[
+    Arg('target', 'Bootstrap USER@HOST; root or an existing administrator with sudo -n'),
+    Opt('--user-data', 'Supported APEX cloud-config file'),
+    Opt('--port', 'Bootstrap SSH port; otherwise use SSH configuration'),
+    Opt('--identity-file', 'SSH private identity file; otherwise use SSH configuration/agent'),
+])
+
+
+def run(ctx, args):
+    initialize(ctx.paths.commons, args.target, args.user_data, args.port, args.identity_file,
+               progress=ctx.log.info)
+    return 0