The broker-admin marker ends in a newline, and the transcript never says a credential

The verify reads the marker with the shell's read, which fails at end of file
without a line ending; the action ran and its verify said no. And the applier
reports each action with its command line, two of which now carry the real
store and broker passwords — the installer masks the values it made in
everything it says.

internal/bootstrap/rootsecrets_test.go

@@ -121,3 +121,47 @@ func TestRootSecretsAreKeptAcrossRuns(t *testing.T) {
 		t.Fatal("a dry run wrote a secret")
 	}
 }
+
+// Nothing the installer says after making the credentials contains them.
+func TestTheTranscriptNeverSaysTheCredentials(t *testing.T) {
+	var said []string
+	say := Masking(func(l string) { said = append(said, l) }, RootCredentials{Store: "STORE-PW", Broker: "BROKER-PW"})
+	say("created context-schemas (docker run -e MESH_STORE_INVENTORY=postgres://postgres:STORE-PW@127.0.0.1:5432/inventory)")
+	say("failed broker-admin (sh -c lavinmqctl change_password guest 'BROKER-PW' && echo x)")
+	for _, l := range said {
+		if strings.Contains(l, "STORE-PW") || strings.Contains(l, "BROKER-PW") {
+			t.Errorf("said a credential: %s", l)
+		}
+	}
+	if !strings.Contains(said[0], "postgres:…@") || !strings.Contains(said[1], "guest '…'") {
+		t.Errorf("the lines were not the same lines with the values masked: %v", said)
+	}
+}
+
+// The broker-admin marker is written with a line ending, because the verify reads it with `read`.
+func TestTheBrokerAdminMarkerHasALineEnding(t *testing.T) {
+	template, err := os.ReadFile("../../examples/foundation-first-node.lock")
+	if err != nil {
+		t.Skip("no example bundle beside this checkout")
+	}
+	r, err := Rewrite(template, "sha256:"+strings.Repeat("ab", 32))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := RewriteRoot(&r, RootCredentials{Store: "s", Broker: "b"}); err != nil {
+		t.Fatal(err)
+	}
+	for _, res := range r.Declaration.Resources {
+		a, ok := res.(*declaration.Action)
+		if !ok || a.ID != "broker-admin" {
+			continue
+		}
+		cmd := strings.Join(a.Command, " ")
+		if !strings.Contains(cmd, "&& echo ") || strings.Contains(cmd, "printf %s") {
+			t.Errorf("the marker is written without a line ending: %s", cmd)
+		}
+		if !strings.Contains(strings.Join(a.Verify, " "), "read m <") {
+			t.Errorf("the verify does not read the marker: %v", a.Verify)
+		}
+	}
+}