Preserve directory reload behavior

[sehkone]

Preserve directory reload behavior

Context

The audit-store mount gate is a filesystem-mode startup decision. Issue #925 requires directory mode to reach none of that gate: no mount check, refusal, or new diagnostic. The merged daemon captures all registrar settings at startup and rejects a SIGHUP reload that changes audit_store_dir or audit_store_enforcement whenever the endpoint was initially enabled. Consequently an enabled directory daemon can now reject an otherwise ordinary directory-store path reload and log a new audit-gate diagnostic. That diagnostic is a hard-coded English string even though the target requires every added operator-facing string in English and Korean.

Scope

Limit audit-store reload protection to the filesystem mount verdict it is needed to preserve. An endpoint that started in directory mode and reloads another directory configuration must retain its pre-change reload behavior: it performs no mount-gate work and receives no audit-store mount verdict diagnostic. Preserve the one-startup-verdict safety rule for any reload that would otherwise make a filesystem handler disagree with the filesystem verdict selected at process start; require a service restart for such a transition rather than silently applying it.

Render every remaining reload-rejection message in both English and Korean through the daemon's established locale selection, including the setting name and running/reloaded values needed to correct it. Update the two manuals so they describe the actual reload boundary without claiming that all enabled endpoints freeze both audit-store settings.

Acceptance criteria

• An endpoint that started in directory mode accepts a SIGHUP reload changing only audit_store_dir while remaining in directory mode, rebuilds from the reloaded settings, performs no mount metadata probe, and emits no mount-gate warning or reload rejection.
• Filesystem-mode reloads cannot replace or reinterpret the process-lifetime mount verdict. A reload that would make the selected filesystem verdict disagree with its handler is rejected until service restart.
• A disabled endpoint retains its existing reload behavior and never gains an audit-store reload check or diagnostic.
• Every audit-store reload rejection emitted by bootroot-agent has English and Korean renderings selected by the existing daemon locale mechanism; no literal English-only reload error remains.
• The English and Korean configuration and operations pages describe the same filesystem-only reload boundary and directory-mode behavior.
• No audit_store_* key, installer path, Compose renderer, mount predicate, or protocol response changes.

Constraints

• Do not re-check a mount after daemon startup or alter the st_dev predicate.
• Do not let an unmounted filesystem store stop the daemon or leave its adopted socket unanswered.
• Do not change behavior, output, or exit status for a disabled endpoint.
• Do not use process-environment mutation in tests.
• Do not change the audit record-store implementation or its layout.

Out of scope

• The empty registrar_health response contract and endpoint refusal test coverage.
• Installer fail-closed behavior, record migration, or capacity health.
• A general redesign of daemon configuration reloads unrelated to the two audit-store settings.

Test plan

• Exercise directory-to-directory reload through the daemon reload composition path and assert the reloaded path is used without a mount gate or rejection.
• Exercise filesystem-preserving and enforcement-changing reloads to prove that a process-lifetime filesystem verdict cannot diverge from the handler that would serve it.
• Capture English and Korean reload rejection diagnostics and assert the localized message carries the affected setting and both values.
• Rebuild both manuals with ./scripts/check-docs.sh, then run formatter, clippy, core tests, and the repository-required Docker E2E matrix.

Dependencies

None. Part of #925. Part of #773.

Pointers

• src/bin/bootroot-agent.rs:64 — initial registrar settings are captured above the reload loop; :107 applies the broad guard.
• src/config.rs:646 — current audit-store reload validator; :663 rejects a changed store path and :695 constructs the English-only diagnostic.
• src/registrar.rs:675 — the endpoint's process-lifetime gate and filesystem-only mount probe.
• src/daemon_messages.rs:46 — locale-selected daemon diagnostics to extend for any remaining reload rejection.
• docs/en/configuration.md:621, docs/ko/configuration.md:593, docs/en/operations.md:996, and docs/ko/operations.md:941 — current reload documentation to align.