Keep PBS guidance checks credential-safe and TLS-bounded

Completed PR 2362 CI still required the retired credential-bearing PBS bootstrap command, and CodeQL reported an implicit TLS protocol floor in its local fixture. Assert the accepted read-only and private-file guidance instead, forbid the unsafe forms, and explicitly require TLS 1.2 or later in the fixture. No product or permission changes.

Contract-Neutral: Documentation regression assertions and local TLS test fixture only; runtime and public contracts unchanged.
Change-source: pulse-maintainer

internal/repoctl/setup_bootstrap_docs_test.go

@@ -17,10 +17,22 @@ func TestSetupBootstrapDocsStayOnCanonicalArtifactContract(t *testing.T) {
 	pbsRel := "docs/PBS.md"
 	pbsDoc := readRepoFile(t, pbsRel)
 	assertContainsAll(t, pbsRel, pbsDoc, []string{
-		`curl -fsSL "http://<pulse-ip>:7655/api/setup-script?type=pbs&host=https://<pbs-ip>:8007&pulse_url=http://<pulse-ip>:7655" | { if [ "$(id -u)" -eq 0 ]; then PULSE_SETUP_TOKEN="<setup-token>" bash; elif command -v sudo >/dev/null 2>&1; then sudo env PULSE_SETUP_TOKEN="<setup-token>" bash; else echo "Root privileges required. Run as root (su -) and retry." >&2; exit 1; fi; }`,
-		"Pulse generates that full command for you from **Settings → Infrastructure**",
+		"### Method 1: API-Only Connection (Recommended)",
+		"proxmox-backup-manager acl update / Audit --auth-id pulse-monitor@pbs",
+		"proxmox-backup-manager acl update / Audit --auth-id 'pulse-monitor@pbs!pulse-token'",
+		`chmod 600 "$HOME/.config/pulse/pbs-agent-token"`,
+		`--output "$HOME/.config/pulse/pbs-agent-install.sh"`,
+		"https://pulse.example.com/install.sh",
+		`--token-file "$HOME/.config/pulse/pbs-agent-token"`,
+		"Stop if the download fails",
+		"Do not bypass certificate checks",
 	})
 	assertContainsNone(t, pbsRel, pbsDoc, []string{
-		`curl -sSL "http://<pulse-ip>:7655/api/setup-script?type=pbs&host=https://<pbs-ip>:8007&pulse_url=http://<pulse-ip>:7655" | bash`,
+		"PULSE_SETUP_TOKEN=",
+		"sudo env PULSE_SETUP_TOKEN=",
+		"curl -k",
+		"--insecure",
+		`--token "`,
+		"| bash",
 	})
 }

scripts/tests/test_pbs_docs.py

@@ -79,6 +79,7 @@ def server(cert, key, status=200, installer=None, installer_path="/install.sh"):
 
     http = HTTPServer(("127.0.0.1", 0), Handler)
     context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
+    context.minimum_version = ssl.TLSVersion.TLSv1_2
     context.load_cert_chain(str(cert), str(key))
     http.socket = context.wrap_socket(http.socket, server_side=True)
     thread = threading.Thread(target=http.serve_forever, daemon=True)