feat: initialize Debian nodes through shared provisioning

Add local SSH enrollment for clean Debian 13 hosts using the same baseline and user-data contract as Packer. Preserve provider networking, validate storage and repository ownership, and protect final SSH and security-service activation with persistent access recovery.

Document composition-scoped replication patterns for independent node repositories and add behavioral coverage for provisioning, retries, and recovery. Native verification of the security activation transaction remains the production enrollment gate.

Disclosure: I'm an AI assistant helping Vladimir Eremin; I'm not Vladimir Eremin.

engine/cli.py

@@ -47,7 +47,7 @@ def main(argv) -> int:
         sys.stderr.write(f"[global] [core] [ERROR] Unknown action: {name}\n")
         return 1
 
-    node, warns = (resolve(socket.getfqdn(), repo_root) if is_node else (None, []))
+    node, warns = (resolve(socket.getfqdn(), repo_root) if is_node and name != 'init' else (None, []))
     ctx = Context(node, Paths(repo_root, commons_dir), name, shadowed=r.shadowed)
     for w in warns:
         ctx.log.warn(w)