Bundled deterministic setup without shell orchestration

• setup needs more than one deterministic setup action
• the steps are still one finite native preparation lane
• today the repo uses a shell script only to orchestrate copy, env-file, directory, secret-file prep, or shared Docker network bootstrap

• it turns a repo pattern into something humans, CI, and agents can read the same way
• it makes the next command obvious instead of implied by README drift
• it keeps readiness, setup, and execution explainable in receipts and diagnostics

Use this when one setup task honestly owns several deterministic setup actions and they should still stay in one governed action body.

The example keeps both host prep and shared Docker network bootstrap under ensure_bundle instead of smuggling the same behavior through shell orchestration.

version: 1project:  name: action-ensure-bundle  description: Focused example for bundled deterministic setup bootstrapexecution:  default_context: host  contexts:    host:      backend: nativetasks:  bootstrap:local:    context: host    action:      kind: ensure_bundle      steps:        - kind: ensure_container_network          name: local-dev        - kind: copy_if_missing          from: .env.example          to: .env.local        - kind: ensure_env_file          path: .env.local          vars:            APP_ENV:              value: local              mode: replace            API_TOKEN:              random:                bytes: 24                encoding: hex        - kind: ensure_directory          path: .cache/ota        - kind: ensure_file          path: .secrets/dev-token          random:            bytes: 24            encoding: hexworkflows:  default: local-bootstrap  local-bootstrap:    prepare:      task: bootstrap:localmetadata:  ota:    minimum_version: "1.6.21"

Use ensure_bundle only for deterministic setup actions built from action primitives.

If the lane needs structural dependency hydration such as package install or image pull, use prepare.kind: sequence instead of stretching ensure_bundle past deterministic setup.

If individual steps should be reused independently or surfaced as operator-visible entrypoints, keep them as separate finite tasks instead of collapsing them into one bundle.