Promote apt lock timeout and bounded boot upgrade to sandbox

[akuzminsky]

Promotes the apt lock timeout and the bounded boot security upgrade from environments/development to environments/sandbox. Second step of the promotion path; modules/ still to follow.

Straight copy of four items, verified byte-identical to the development overlay afterwards. There was no pre-existing divergence between the two overlays in these files, so nothing was clobbered:

• manifests/apt_lock_timeout.pp (new)
• files/github_runner/gha-boot-security-upgrade.sh (new)
• manifests/repos.pp — declares the class with stage => init
• manifests/github_runner.pp — bounded Exec[gha-boot-security-upgrade]

Validated in development first

From a real gha_runner bootstrap (ip-10-0-1-142):

Notice: /Stage[init]/Profile::Apt_lock_timeout/File[/etc/apt/apt.conf.d/99-lock-timeout]/ensure: defined content

The Stage[init] prefix is the important part — it confirms the drop-in is applied before every Package resource in stage main, which was the piece of the design most likely to surprise. That host's AMI predates infrahouse/infrahouse-ubuntu-pro#20, so the file did not exist and Puppet created it, which is exactly the population this change is for.

The same run also confirmed:

• all five unmask execs fire, so the units genuinely are masked by terraform-aws-cloud-init's bootcmd when Puppet runs, and the execs are load-bearing rather than dead code
• gha-boot-security-upgrade.sh deploys and the exec succeeds
• the /run/gha-boot-upgrade.done marker stops it re-running on the second catalog pass
• Package[postfix], Package[mailutils] and Package[mutt] — the three resources that failed in Own DPkg::Lock::Timeout in Puppet and bound Exec[gha-boot-security-upgrade] #289 — install cleanly
• bootstrap lifecycle hook completes CONTINUE

Note for later

That instance reached CONTINUE at 719s of the 1200s hook budget, with the first catalog alone taking 514s. The boot upgrade's 480s worst case therefore leaves thinner margin than the budget suggests in isolation — a worst-case run would land near 1150s. Not changed here by decision; recorded so it is not a surprise later.

Refs #289

🤖 Generated with Claude Code