test: container lab for the two-tier apply

A disposable ubuntu container, a fake private tier and a fake bootstrap
endpoint, so the whole documented path — chezmoi init --apply, dotup pick,
dotup private, cmp apply, dotsecrets — can run end to end without touching a
real machine or a real credential. The fake tier mirrors the real one's
structure (seven secrets and one alias) because dotsecrets is copied verbatim
and the "8 exports, not 7" assertion depends on that cardinality; its ids are
sequential and obviously synthetic.

check-verbatim.sh keeps the fake tier's copies of shipped files honest, and
snapshot.sh records file modes so a 644 where a 600 belongs is a diff.

.tests/lab/snapshot.sh

@@ -0,0 +1,30 @@
+#!/bin/sh
+# Turn a WORKING TREE into a bare repo the lab server can hand out.
+#
+# `git clone` of a checkout only ever produces committed refs, so testing a
+# change used to mean pushing it first -- which is backwards, and is the reason
+# every bug in this repo was found by a human on a real machine instead of by
+# a test. Copying the tree and committing it into a throwaway repo means the
+# code under test is whatever is on disk right now, staged or not.
+#
+# usage: snapshot.sh <src-tree> <serve-root> <name>
+set -eu
+src=$1; root=$2; name=$3
+work=$(mktemp -d)
+trap 'rm -rf "$work"' EXIT
+
+# --delete is pointless into a fresh mktemp dir, but it documents intent if
+# this is ever pointed at a reused path.
+tar -C "$src" --exclude=.git -cf - . | tar -C "$work" -xf -
+
+git -C "$work" init -q -b main
+git -C "$work" add -A
+git -C "$work" \
+	-c user.email=lab@example.invalid -c user.name=lab \
+	commit -qm "working-tree snapshot of $name"
+
+rm -rf "$root/$name.git"
+mkdir -p "$root"
+git clone -q --bare "$work" "$root/$name.git"
+git -C "$root/$name.git" update-server-info
+printf '%s\n' "$root/$name.git"