Jean-Gabriel Gill-Couture
cb9a649ffa
Two HARMONY_FLEET_VM_E2E-gated tests on a real VM agent, nothing mocked: (1) agent connects to NATS through the callout with its Zitadel machine identity, fetches a referenced secret from OpenBao via the groups claim (flattening Action verified live), and the container env carries the value (SSH podman inspect ground truth); (2) deleting the deployment policy denies the next fetch, surfaced as Phase::Failed naming the denied secret.