[ksteffe]

Purpose

Closes #11 when accepted. Allow a separately owned Coder integration (for example, a future Runtime Conditions consumer) to supply trusted PADE capability bindings after PADE installation without duplicating capability-name mappings in Terraform.

Changes

• Make broker_capabilities optional; existing static templates continue to generate the same broker-only bindings.
• Add a broker_binding output with the operator's non-secret provider, endpoint, audience, and identity settings. Reuse existing bindings_path and scripts outputs.
• With no static capabilities, write an empty, mode-0600 bindings file before fetching PADE, then write it again at normal installation. This avoids retaining stale downstream-created bindings if a restart's download fails.
• Document the trusted writer and ordered Coder synchronization contract, with a strict boundary: portable workload intent is not authorization.
• Add Terraform and container-backed installer regression tests: static compatibility, no static capabilities, output contract, downstream replacement, successful restart, and failed-download stale-binding reset.

Trust boundaries

• This PR does not install or parse Runtime Conditions, change PADE protocols, modify broker policy, or widen provider grants.
• A trusted downstream integration must validate demand and evaluate explicit operator policy, then atomically replace the module-managed file with mode 0600 after installation and before starting dependent workloads.
• The bindings file is workspace-user-writable; it is configuration, not a sandbox. Broker authentication/authorization and downstream resource IAM remain the actual authority boundaries.

Validation

• Terraform terraform test, terraform fmt -check -recursive, ShellCheck, and Bun container-backed installer tests run in this repository's PR workflows.
• Tests have been added but were not yet run in this chat; CI results should be reviewed before merge.
• No live Coder/GCE broker fulfillment was performed.

Integration follow-up

The Runtime Conditions → Coder composition is intentionally a separate project task in rc-pade, not added to this generic module. Upstream Coder Registry PR coder/registry#1166 is unchanged.