Add fail-closed NPM ACME bootstrap entrypoint

bootstrap.sh

@@ -3,14 +3,35 @@ set -euo pipefail
 
 readonly ACME_AUTHORITY_ROOT="${ACME_AUTHORITY_ROOT:-/acme_authority}"
 readonly PATCHER="${ACME_AUTHORITY_ROOT}/patch_acme.py"
+readonly NPM_ENTRYPOINT="${NPM_ENTRYPOINT:-/init}"
 
 log()
 {
     printf '[acme-authority] %s\n' "$*"
 }
 
+fail()
+{
+    log "ERROR: $*"
+    exit 1
+}
+
 log "Bootstrap starting"
 
+[[ -r "$PATCHER" ]] ||
+    fail "patcher not readable: $PATCHER"
+
+command -v python3 >/dev/null 2>&1 ||
+    fail "python3 is not available"
+
+[[ -n "$NPM_ENTRYPOINT" ]] ||
+    fail "NPM_ENTRYPOINT is empty"
+
+log "Applying configured ACME authority gates"
+
 python3 "$PATCHER"
 
-log "Bootstrap completed"
+log "ACME authority patch and verification completed"
+log "Handing off to NPM entrypoint: $NPM_ENTRYPOINT"
+
+exec "$NPM_ENTRYPOINT"