Test: Prove verified bootstrap boundaries

tests/setup/root-server-bootstrap-contract

@@ -127,6 +127,7 @@ esac
     write_executable(stub_dir / "runuser", common + r'''
 log runuser "$@"
 [[ "${1:-}" == -u && "${2:-}" == gib && "${3:-}" == -- ]] || exit 97
+target_user="$2"
 shift 3
 if [[ "${1:-}" == install && "${2:-}" == -d && "${3:-}" == -m && "${4:-}" == 0700 && "${5:-}" == -- ]]; then
   /usr/bin/install "${@:2}"
@@ -140,13 +141,17 @@ if [[ "${1:-}" == install && "${2:-}" == -m && "${3:-}" == 0600 && "${4:-}" == -
     >"$PANAMA_BOOT_FIXTURE_ROOT/state/target-key-meta"
   exit 0
 fi
-"$@"
+PANAMA_BOOT_TARGET_USER="$target_user" "$@"
 ''')
     write_executable(stub_dir / "ssh-keygen", common + r'''
 log ssh-keygen "$@"
 exec /usr/bin/ssh-keygen "$@"
 ''')
     write_executable(stub_dir / "git", common + r'''
+if [[ "${PANAMA_BOOT_TARGET_USER:-}" != gib ]]; then
+  log git-rejected-direct "$@"
+  exit 96
+fi
 log git "$@"
 case "${1:-}" in
   init)
@@ -473,6 +478,7 @@ def configure_case(
         "signal-int-before-activation-cleanup-fails",
         "signal-int-during-candidate-preparation",
         "signal-term-during-backup-preparation",
+        "direct-root-git-probe",
     ):
         target_keys.write_text(TARGET_PUBLIC_KEY)
     elif name == "safe-root-key-copy":
@@ -485,6 +491,29 @@ def configure_case(
     return fixture_root, stub_dir
 
 
+def assert_checkout_runs_as_target(name: str, calls: str, fixture_root: Path) -> None:
+    call_lines = calls.splitlines()
+    git_indices = [
+        index for index, line in enumerate(call_lines) if line.startswith("git ")
+    ]
+    if not git_indices:
+        return
+
+    checkout = fixture_root / "home/gib/.local/share/Panama"
+    expected_mkdir = f"runuser -u gib -- mkdir -p {checkout.parent} "
+    if expected_mkdir not in call_lines:
+        note(f"{name}: checkout parent directory was not created as the target user")
+
+    for index in git_indices:
+        expected_runuser = f"runuser -u gib -- {call_lines[index]}"
+        if index == 0 or call_lines[index - 1] != expected_runuser:
+            note(f"{name}: checkout Git operation bypassed the selected target user")
+            break
+
+    if any(line.startswith("git-rejected-direct ") for line in call_lines):
+        note(f"{name}: checkout attempted a direct root Git operation")
+
+
 def run_case(
     name: str,
     *,
@@ -614,6 +643,7 @@ fi
         note(f"{name}: bootstrap timed out, likely while reading an unsupported object")
     calls = (fixture_root / "calls").read_text()
     output = b"".join(chunks).decode(errors="replace")
+    assert_checkout_runs_as_target(name, calls, fixture_root)
     return status, output, calls, fixture_root, process.pid
 
 
@@ -652,6 +682,29 @@ else:
         note("actual-root-fixture-guard: boot mutated its rejected fixture root")
 
 
+probe_root, probe_stub_dir = configure_case("direct-root-git-probe")
+probe_checkout = probe_root / "home/gib/.local/share/Panama"
+probe_env = {
+    **os.environ,
+    "PATH": f"{probe_stub_dir}:/usr/bin:/bin",
+    "PANAMA_BOOT_FIXTURE_ROOT": str(probe_root),
+    "PANAMA_BOOT_REVISION": BOOT_REVISION,
+}
+direct_git = subprocess.run(
+    [str(probe_stub_dir / "git"), "init", str(probe_checkout)],
+    env=probe_env,
+    capture_output=True,
+    text=True,
+)
+probe_calls = (probe_root / "calls").read_text()
+if direct_git.returncode != 96:
+    note("direct-root-git-probe: Git adapter accepted a root-owned checkout call")
+if (probe_checkout / ".git").exists():
+    note("direct-root-git-probe: rejected root-owned Git call mutated the checkout")
+if "git-rejected-direct init " not in probe_calls:
+    note("direct-root-git-probe: fixture did not exercise the direct Git rejection")
+
+
 unsafe_cases = (
     "missing",
     "empty",