Add platform infrastructure configuration

scripts/validate/test-k3s-local-recovery-fmask.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+
+# Regression test for the NTFS mask used by the recovery volume. The 0177
+# file mask removes owner execute plus every group/other permission, producing
+# mode 0600 for the KeePass database and LUKS container.
+set -Eeuo pipefail
+
+readonly REPOSITORY_ROOT="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd -P)"
+readonly VALIDATOR_PATH="${REPOSITORY_ROOT}/scripts/validate/k3s-local-recovery.sh"
+
+# shellcheck source=/dev/null
+source "$VALIDATOR_PATH"
+
+readonly LIVE_SAFE_OPTIONS='rw,nosuid,nodev,noexec,relatime,uid=1000,gid=1000,dmask=0077,fmask=0177,iocharset=utf8'
+
+if ! _k3slrv_outer_masks_secure "$LIVE_SAFE_OPTIONS"; then
+  printf '%s\n' \
+    'TEST FAILURE: recovery validator rejected secure fmask=0177' >&2
+  exit 1
+fi
+
+printf '%s\n' 'PASS: recovery validator accepts secure fmask=0177'