Refuse registrar without audit mount (#925)

[sehkone]

Summary

• Gate enabled filesystem-mode registrar endpoints on a cheap start-time mount-point check before the production handler opens the audit store.
• Preserve that mount verdict for the activated socket across SIGHUP reloads; changing the audit-store directory or enforcement mode requires a daemon restart.
• Keep the socket endpoint responsive with permanent registrar_unavailable / audit_unwritable refusals that have fresh request IDs and correlated daemon logs, while certificate renewal continues.
• Document the runtime behavior in both manuals and update the request-ID contract and changelog.

Closes #925

Part of #773

Part of #775

Test plan

• Confirm an enabled filesystem-mode endpoint refuses without opening or creating the audit store, while mounted and directory-mode deployments retain production behavior.
• Confirm the start-time mount verdict survives SIGHUP reloads and reloads that change its audit-store inputs are rejected.
• Confirm mint and deregister callers receive permanent registrar_unavailable / audit_unwritable responses with distinct generated request IDs, empty health, and per-refusal log correlation.
• Confirm malformed payloads retain the existing handler-refusal path, and daemon renewal duties continue while unrelated endpoint dependency errors still fail startup.
• Verify CI passed the full quality, documentation, test-core, and Docker E2E matrix. Locally, scripts/preflight/run-all.sh --skip-hosts passed quality, docs, deploy smoke, test-core, and both lifecycle no-hosts runs before the unrelated reinit scenario rejected Docker Desktop’s nonlocal 172.17.0.1 bind address.
• Verify hosts-mode E2E coverage: this workspace direct hosts-matrix attempt completed the no-hosts lifecycle and reached the documented sudo -n prerequisite; it cannot continue without passwordless sudo. The branch local-hosts and remote-hosts CI jobs passed.

[sehkone]

[Reviewer Round 1]

Request changes.

• P1 — The mount gate can become detached from the handler after SIGHUP reloads. audit_store_mount_gate stores the first path, enforcement mode, and verdict in a OnceLock, while resolve_registrar_service rebuilds the production handler using the newly reloaded settings. For example, a daemon started in directory mode can reload into filesystem mode with an unmounted store and still build the production handler; similarly, a reload can change from a mounted store to a new unmounted path. That lets AuditRecordStore::open write beneath an unmounted filesystem-mode store—the condition this PR is meant to prevent. Reject audit-store configuration changes on reload, or otherwise ensure the gate and handler always use the same settings.

• P2 — The required daemon-degradation test is absent. an_unmounted_store_bypasses_production_handler_construction only exercises the handler-selection helper, and the endpoint test only exercises the refusing handler. Neither runs run_daemon to prove, on one fixture, that the endpoint answers refusals while profile renewal and fast-poll duties still run and that run_daemon does not return an error. This is an explicit acceptance criterion and would catch mistakes in the post-resolution task wiring.

[sehkone]

[Review Verdict Round 1: NOT_APPROVED]

[sehkone]

[Author Round 1]

Review feedback addressed and pushed (a4a22899).

• Fixed — P1: HUP reload now rejects changes to the audit-store mount-gate settings for an enabled registrar endpoint, keeping the cached mount verdict aligned with the active handler configuration. Added config coverage and updated English/Korean docs.

• Fixed — P2: Added a daemon-level test proving an unmounted audit store returns permanent audit_unwritable refusals while profile renewal and fast-poll authentication continue, with clean daemon shutdown.

Verified with formatting, clippy (including Linux target), docs checks, full preflight, and the E2E matrix. The PR description remains accurate and was left unchanged.

[sehkone]

[Reviewer Round 2]

[Reviewer Round 2]

Approved.

• P1 resolved: reload now rejects changes to audit_store_dir and audit_store_enforcement while the endpoint is active, preserving alignment with the cached mount verdict.
• P2 resolved: the daemon-level test exercises a real accepted request, confirms the permanent typed refusal, verifies profile and fast-poll activity, and cleanly shuts down without a daemon error.

No new findings.

[sehkone]

[Review Verdict Round 2: APPROVED]

[sehkone]

Suggested squash commit

Title

Refuse registrar without audit mount

Body

Keep the daemon renewing certificates while its registrar endpoint returns
a typed permanent refusal until the filesystem audit store is mounted.
Preserve the startup mount verdict across reloads so a changed store
configuration only takes effect on restart.

Closes #925