[simonjcarr]

Summary

• remove operator-managed PASSWORD_MANAGER_API_IMAGE from examples, bundle staging, and optional env handling
• pin password-manager-api and password-manager-migrate directly to the digest from deploy/password-manager-release.json
• migrate legacy .env overrides away during start/upgrade and fail startup if compose drifts from the descriptor
• add bundle/release tests for descriptor-derived image stamping and the CT-Ops browser-envelope /user-key payload

Validation

• python3 deploy/scripts/validate-password-manager-release.py deploy/password-manager-release.json
• bash deploy/scripts/test-password-manager-release-contract.sh
• bash deploy/scripts/test-password-manager-compose.sh
• bash deploy/scripts/test-password-manager-nginx.sh
• bash deploy/scripts/test-password-manager-startup.sh
• bash deploy/scripts/test-upgrade.sh
• bash deploy/scripts/test-start.sh
• bash deploy/scripts/test-web-entrypoint.sh
• bash deploy/scripts/test-support-data.sh
• bash deploy/scripts/test-agent-release-password-manager-image-ref.sh
• bash deploy/scripts/test-install.sh
• BETTER_AUTH_SECRET=build-time-placeholder POSTGRES_PASSWORD=build-time-placeholder PASSWORD_MANAGER_CT_OPS_ED25519_PRIVATE_KEY=build-time-placeholder docker compose -f docker-compose.single.yml config
• node --experimental-strip-types --test apps/web/lib/password-manager/client.test.mjs
• pnpm install --frozen-lockfile
• pnpm --dir apps/web type-check
• go test ./internal/userkey ./internal/httpapi in temporary ct-password-manager worktree at cb714edc1e6d813655fc3dd352c7c0fd92f4699a
• git diff --check