test: container lab for the two-tier apply

A disposable ubuntu container, a fake private tier and a fake bootstrap
endpoint, so the whole documented path — chezmoi init --apply, dotup pick,
dotup private, cmp apply, dotsecrets — can run end to end without touching a
real machine or a real credential. The fake tier mirrors the real one's
structure (seven secrets and one alias) because dotsecrets is copied verbatim
and the "8 exports, not 7" assertion depends on that cardinality; its ids are
sequential and obviously synthetic.

check-verbatim.sh keeps the fake tier's copies of shipped files honest, and
snapshot.sh records file modes so a 644 where a 600 belongs is a diff.

.tests/lab/fake-private/run_after_50-secrets.sh.tmpl

@@ -0,0 +1,44 @@
+#!/bin/sh
+# run_after_50-secrets.sh -- PRIVATE tier.
+#
+# Regenerate ~/.config/zsh/secrets.zsh at the end of every `cmp apply`.
+#
+# The `run_after_` prefix is load-bearing. It guarantees this runs once every
+# managed file is on disk, which resolves the deadlock the old repo had: the
+# old .zshrc fetched secrets on line 62 using a token that line 58's file had
+# not written yet. Ordering by prefix rather than by hope.
+#
+# This script is a wrapper and nothing else. The work lives in `dotsecrets`,
+# which you can also run by hand after rotating a key in bws -- one
+# implementation, so the scheduled path and the manual path cannot drift apart
+# and start disagreeing about what a valid secrets.zsh looks like.
+#
+# IT ALWAYS EXITS 0. A machine on a train with no signal must still be able to
+# finish an apply. `dotsecrets` leaves an existing secrets.zsh untouched when
+# it cannot fetch, so the failure mode here is "yesterday's keys and a warning"
+# rather than "the apply died half way through".
+
+set -u
+{{ if ne .chezmoi.destDir .chezmoi.homeDir }}
+# Rendered only when this apply is aimed somewhere other than the home
+# directory -- `chezmoi apply --destination /tmp/whatever`, which is how this
+# tier gets tested. `dotsecrets` resolves its own paths from $HOME, so running
+# it here would reach straight past the throwaway destination and rewrite the
+# real ~/.config/zsh/secrets.zsh. A test that mutates the machine it is
+# protecting is not a test.
+printf 'run_after_50-secrets: destination is {{ .chezmoi.destDir }}, not the home directory; skipping\n' >&2
+exit 0
+{{ end }}
+DOTSECRETS="{{ .chezmoi.homeDir }}/.local/bin/dotsecrets"
+
+if [ ! -x "$DOTSECRETS" ]; then
+	printf 'run_after_50-secrets: %s is missing or not executable; skipping\n' \
+		"$DOTSECRETS" >&2
+	exit 0
+fi
+
+if ! "$DOTSECRETS"; then
+	printf 'run_after_50-secrets: refresh failed (see above). The apply itself is fine.\n' >&2
+fi
+
+exit 0