Replace Python development tooling with Make and containerized shell

docs/implementation.md

@@ -676,3 +676,32 @@ the supplementary failures are recorded and are not suppressed. The required
 normal test and lint commands pass. No optional security scan or email delivery
 was performed. Resend remains intentionally unconfigured; infrastructure stays up
 and product startup awaits manual `kv/email` provisioning.
+
+### Make and shell development tooling
+
+The local development tooling now runs POSIX-style shell scripts in a Docker
+image containing Docker CLI, curl, jq, Git, OpenSSL, flock and ShellCheck. All eight
+Python scripts were removed. Make remains the entry point; `make email` replaces
+the Python credential prompt. Host requirements are Make, shell and local Docker
+with Compose/BuildKit. The tool image is built from a freshly pulled stable Docker
+CLI digest; application/infrastructure stable resolution and atomic local pins
+remain intact. Tooling mounts the local Docker socket and workspace at its host
+path; remote Docker engines are unsupported.
+
+Static Agent HCL sources replace configuration generation and contain only Vault
+template expressions. Bootstrap preserves existing Vault state and credentials,
+protects its private files, and fails when Resend credentials are absent. The shell
+infrastructure check now explicitly validates real Mongo transaction commit and
+rollback with each application's Vault-issued identity. The rotation command
+retains its unchanged-process and expected-response checks and TTL restoration.
+
+Validation of the shell replacement passed: `make build`, `make test-dev-tooling`,
+`make test-dev-infra`, Compose configuration validation and `git diff --check`.
+An isolated `sxchnge-shell-check` project passed first bootstrap, live transaction
+and lease checks, and repeated bootstrap; its containers, volumes and temporary
+state were removed. `make test-dev-rotation` passed three real Vault replacements
+with unchanged BFF PID, 1,048 expected HTTP responses and zero failures; role TTLs
+were restored and temporary BFF/frontend containers removed. `make up` exits at
+the intentional missing-Resend check, with infrastructure healthy. Backend and
+frontend code did not change in this revision; their earlier test/lint results
+and supplementary legacy test limitations above still apply. No email was sent.

docs/local-development.md

@@ -5,9 +5,13 @@ Task [#42](https://git.sendico.io/tech/sxchnge/issues/42),
 
 ## Build and bootstrap
 
-Requires Docker with Compose v2 and BuildKit, Python 3.10+ and Git. Docker builds
-Go, protobuf bindings and Flutter web; host Go, protoc and Flutter installations
-are not required for `make build && make up`. The first Flutter SDK download can
+Requires Make, a POSIX shell and a local Docker engine with Compose v2 and
+BuildKit. Docker builds Go, protobuf bindings and Flutter web; host Go, protoc
+and Flutter installations are not required for `make build && make up`. The
+tooling container includes Docker CLI, curl, jq, Git and OpenSSL. No host Python,
+jq, curl or Git installation is needed for these Make targets. It mounts
+the local Docker socket and workspace to orchestrate Compose; a remote Docker
+daemon is not supported. The first Flutter SDK download can
 take several minutes. Both ARM64 and AMD64 build from the same source definitions.
 
 ```sh
@@ -52,7 +56,7 @@ containers never mount it. You can also provision the same secret with a hidden
 terminal prompt, without placing the API key in shell history:
 
 ```sh
-python3 dev/local.py email
+make email
 make up
 ```
 
@@ -169,6 +173,7 @@ make ps
 make logs
 make down             # preserves named volumes and local bootstrap material
 make up               # idempotent provisioning and readiness checks
+make test-dev-tooling # offline shell and failure-path checks
 make test-dev-infra   # works before Resend provisioning
 make test-dev-rotation # real Vault rotations under BFF HTTP traffic
 make test-dev         # requires all six services running