feat(geo): Configurable --max-runtime and opt-in --parallel installs

Andrew Dunnrequested to merge
geo/up-runtime-parallel into main

What does this MR do and why?

geo up hardcoded --max-runtime 8h on both sites and built them sequentially. The auto-delete limit is wall-clock since VM creation, not activity, so a load measurement that starts after two sequential omnibus installs can find most of its window already spent and its pair deleted mid-run.

Two changes:

  • --max-runtime DUR on geo up (default unchanged at 8h), forwarded to both site installs. Size it to the measurement; pass 12h+ for load runs that must outlive the build.
  • --parallel overlaps the two installs, cutting roughly one install's worth of wall-clock off the build. The trade is the license gate's timing: serial checks the license between the installs, so an unlicensed primary never buys a secondary build; parallel checks it after both. To cap that downside the healthy-instance short-circuit now covers both sites (previously primary-only), so the gate's failure path re-runs in minutes reusing both VMs. Serial stays the default.

Supporting changes:

  • ensure_firewall tolerated no concurrency: check-then-create races when two ups run at once, and the loser aborted under set -e for a rule that exists. A failed create now falls back to one more describe.
  • Extracting geo_install_site surfaced a latent trap: the per-flag empty-array expansions ("${vflag[@]}") are fatal under set -u on bash 3.2 (macOS /bin/bash, the control plane) and only survived because every real run passed --version. Flags now accumulate in one array that is never empty. Sibling audit: names, taken, and MATRIX_ROWS are guarded or provably non-empty at expansion; install_caproni's args already uses ${args[*]:-}.

Validation

Executed:

  • just ci clean (shellcheck 0.11.0, same pin as the pipeline), bash -n on both scripts.
  • Flag parsing and the state-refuse path exercised live: geo up --max-runtime 12h --parallel against a planted pair-state file refuses correctly; unknown flags still fail.
  • geo_install_site exercised under /bin/bash 3.2 with a stubbed simulation.sh for all three flag shapes (no version/no license, version only, license only): correct argv in every case, no unbound-variable failures.
  • Confirmed no VMs or state files were created by any of the above.

Not executed: a live parallel pair build. The serial default preserves the existing command sequence, and the next Geo measurement run is the natural first live exercise of --parallel with a raised --max-runtime.

Merge request reports