Replace Python development tooling with Make and containerized shell

docs/implementation.md

@@ -676,3 +676,32 @@ the supplementary failures are recorded and are not suppressed. The required
 normal test and lint commands pass. No optional security scan or email delivery
 was performed. Resend remains intentionally unconfigured; infrastructure stays up
 and product startup awaits manual `kv/email` provisioning.
+
+### Make and shell development tooling
+
+The local development tooling now runs POSIX-style shell scripts in a Docker
+image containing Docker CLI, curl, jq, Git, OpenSSL, flock and ShellCheck. All eight
+Python scripts were removed. Make remains the entry point; `make email` replaces
+the Python credential prompt. Host requirements are Make, shell and local Docker
+with Compose/BuildKit. The tool image is built from a freshly pulled stable Docker
+CLI digest; application/infrastructure stable resolution and atomic local pins
+remain intact. Tooling mounts the local Docker socket and workspace at its host
+path; remote Docker engines are unsupported.
+
+Static Agent HCL sources replace configuration generation and contain only Vault
+template expressions. Bootstrap preserves existing Vault state and credentials,
+protects its private files, and fails when Resend credentials are absent. The shell
+infrastructure check now explicitly validates real Mongo transaction commit and
+rollback with each application's Vault-issued identity. The rotation command
+retains its unchanged-process and expected-response checks and TTL restoration.
+
+Validation of the shell replacement passed: `make build`, `make test-dev-tooling`,
+`make test-dev-infra`, Compose configuration validation and `git diff --check`.
+An isolated `sxchnge-shell-check` project passed first bootstrap, live transaction
+and lease checks, and repeated bootstrap; its containers, volumes and temporary
+state were removed. `make test-dev-rotation` passed three real Vault replacements
+with unchanged BFF PID, 1,048 expected HTTP responses and zero failures; role TTLs
+were restored and temporary BFF/frontend containers removed. `make up` exits at
+the intentional missing-Resend check, with infrastructure healthy. Backend and
+frontend code did not change in this revision; their earlier test/lint results
+and supplementary legacy test limitations above still apply. No email was sent.