Add validation tool

tools/validate_upstream_layout.py

@@ -0,0 +1,38 @@
+#!/usr/bin/env python3
+"""Verify that the pinned WEB PANEL PROXY layout still matches our adapter."""
+
+from pathlib import Path
+import sys
+
+
+def main() -> int:
+    if len(sys.argv) != 2:
+        print("usage: validate_upstream_layout.py PATH_TO_EXTRACTED_RELEASE", file=sys.stderr)
+        return 2
+
+    root = Path(sys.argv[1])
+    core = (root / "install-webproxy-core.sh").read_text(encoding="utf-8")
+    panel = (root / "install-panel.sh").read_text(encoding="utf-8")
+
+    checks = {
+        "core port 80 check": core.count("check_install_port 80 caddy"),
+        "core port 443 check": core.count("check_install_port 443 caddy"),
+        "core canonical Caddy patch point": core.count(
+            '    "$CANONICAL_CADDY"\n\nif [[ "$REUSE_CADDY" == "1" ]]; then'
+        ),
+        "panel route": panel.count('"        reverse_proxy 127.0.0.1:8090\\n"'),
+        "panel relay matcher": panel.count(
+            r"r'(?m)^\s*reverse_proxy 127\.0\.0\.1:8080\s*\{'"
+        ),
+    }
+
+    failed = False
+    for name, count in checks.items():
+        status = "OK" if count == 1 else f"FAIL (found {count})"
+        print(f"{name}: {status}")
+        failed |= count != 1
+    return 1 if failed else 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())