Adds tools/federation-harness/ — the permanent test bed for M3+ federation
E2E tests. Boots two gateways (Server A + Server B) on a shared Docker bridge
network with per-gateway Postgres/pgvector + Valkey and a shared Step-CA.
- docker-compose.two-gateways.yml: gateway-a/b, postgres-a/b, valkey-a/b,
step-ca; image digest-pinned to sha256:1069117740e... (sha-9f1a081, #491)
- seed.ts: provisions scope variants A/B/C via real admin REST API; walks
full enrollment flow (peer keypair → grant → token → redeem → cert store)
- harness.ts: bootHarness/tearDownHarness/serverA/serverB/seed helpers for
vitest; idempotent boot (reuses running stack when both gateways healthy)
- README.md: prereqs, topology, seed usage, vitest integration, port override,
troubleshooting, image digest note
No production code modified. Quality gates: typecheck ✓ lint ✓ format ✓
Closes#462
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
