Build service replacement and containers (off by default)

Start from branch phase-7/service-replacement and read spec design 13 plus dependencies #79, #80, #95, #89. Create module phases/harden/modules/service_replace/ adding the two config keys and the replacement/container logic. Write the bats and Pester acceptance tests first; done means all listed refusal, match, revert, and isolation checks pass.

Read first

• Design 13, section 2: the rules that shape it and section 3: turning it on
• Design 13, section 4: when it is worth it
• Design 13, section 5: the data-preservation check and section 6: sequence
• Design 13, section 7: containers and section 8: what it will never do
• Design 13, section 10: acceptance tests (in the lab) and section 9: rehearsal
• Conventions, section 2.2: run-time configuration (the event.conf keys) and the revert timer
• Roadmap, section 4.3: sustain and hardening
• AGENTS.md: hard rules 3 (no blanket actions), 5 (never impede scoring) and 7 (reversible)

Read these before starting. If this issue and the spec disagree, the spec wins; say so in the pull request.

Summary

Add a way to rebuild a scored service, or run it in a container, on the same host, with the same address, users and data. This is off by default. It is only for events whose inject or local rules allow it. A rebuild is allowed only after a full proof that nothing users or the scoring engine rely on is lost, and the old install stays on disk, stopped, so it can be switched back.

Depends on

• Blocked by #89 (checkpoint), #95 (the nginx, Apache and IIS service packs), #80 (restore points) and #79 (the packages module, which installs the container runtime).

Location & Context

• Branch: phase-7/service-replacement. Module ID: harden.service_replace, in phases/harden/modules/service_replace/ (new), with module.yml and the .sh entry points. Design 13 describes the Linux services and containers only. The issue's Pester tests apply only if the module gets a Windows version.
• Run-time keys ALLOW_SERVICE_REPLACE and ALLOW_CONTAINERS in event.conf (Conventions section 2.2). Add placeholders to config/event.conf.example. Neither key is ever set in a shipped profile or a pre-approval rule, so a first-minute run cannot replace anything.
• Tests: tests/phases/harden/service_replace/ (new; bats).

Current Behavior

There is no way to rebuild or containerize a scored service while keeping its data, users and address, for events that allow it. The feature stays off unless named in event.conf.

Plan

1. Add the ALLOW_SERVICE_REPLACE and ALLOW_CONTAINERS keys, both off unless set. Each takes yes:<reference> naming the inject or local rule that allows it. A bare yes is refused. ALLOW_CONTAINERS implies ALLOW_SERVICE_REPLACE for that service.
2. Build the full proof (design 13, section 5): users, mailboxes, pages by hash, database contents, how the service answers, and the scored check on a staging port. Refuse the cut-over (20) unless the inventories match.
3. Follow the sequence in design 13, section 6: build beside the old service on a staging port bound to 127.0.0.1, copy the data, compare, probe, then switch under a revert timer. Keep the old install, stopped.
4. Offer a replacement as an approval item only in the cases in design 13, section 4. Show the reason, the restore point and the last rehearsal time in the plan.
5. Add the container controls (design 13, section 7): Podman or Docker from the distribution's own repositories, images named by digest, non-root with a named exception list, no privileged, no engine socket, no host network, and published ports kept in the firewall.
6. Add the module to its manual entry and its help page (about.txt).

Acceptance tests

Write these first, in bats:

• With both options off, every module refuses (20) and changes nothing. With a bare yes, it refuses and names the missing reference.
• A replacement whose pages, mailboxes or database contents do not all match is refused.
• A deliberately failed probe after the cut-over makes the timer start the old instance, which passes its probe.
• A container definition with privileged, a host network, the engine's socket, or root outside the exception list is refused.
• An image named by tag alone is refused.
• No run changes a host name, an address or a username.
• Each remaining lab test in design 13, section 10 passes (web with a planted file, a database table with one row removed, a mail service rebuilt, a port below 1024, a banned address on Docker, a power cycle).
• Negative test: protected accounts and scored services are untouched before and after.

Done when

• The Linux version passes CI, including the real-host tests on the Ubuntu runner.
• The manual and the module's help page (about.txt) are written.
• Nothing in a shipped profile or a pre-approval rule turns the options on, so a first-minute run cannot replace anything.
• The tests above pass in the lab on the Debian-family and RHEL-family hosts, and each service type's rebuild time is recorded (docs/lab/README.md).

Out of scope

• Mitigating or patching a flaw in place, which comes first: #101 and the patching module (design 10).
• The service packs themselves: #95, #96 and #97.
• Moving a service to another host, or changing its address, port, host name or users. Never offered.
• Removing the old install: a cleanup item (#105).