Merge nucleic/rustic-meadow-koala-wtwq into dev

tests/smoke-rootfs.sh

@@ -29,6 +29,14 @@ COMMON='
   . /etc/os-release; test "$ID" = naros
   readlink /bin/sh | grep -q nash
   test -x /usr/bin/bash.real
+  # nash trusted policy (NASH.md §4.3): present, root-owned, not group/other-writable —
+  # the three properties nash checks before it honors an operator lever. A packaging
+  # slip on any of them silently returns the levers to nobody (or, worse, to the agent).
+  test -f /etc/nucleic/nash.conf
+  grep -q "^require_observation=1" /etc/nucleic/nash.conf
+  test "$(stat -c %u:%a /etc/nucleic/nash.conf)" = "0:644"
+  # The bypass the image used to publish to every shell it started.
+  ! grep -rq NUCLEIC_REAL_BASH /etc/profile.d/
 '
 
 # A runtime-clean sources.list (no build-time copy:// pool left in), scoped away from