20260701 add validation-update-03 VRS mode

deploy/arm64-installer/docs/README.en.md

@@ -33,6 +33,7 @@ Defaults:
 - `MAX_RUNS=-1`
 - `INTERVAL_SECS=600`
 - `TAL_INPUT_MODE=file-live-ta`
+- `RESOURCE_VALIDATION_MODE=validation-update-03`
 - `LIVE_TA_REFRESH_BEFORE_SNAPSHOT=1`
 - `PERIODIC_SNAPSHOT_RESET=0`
 - `PERIODIC_SNAPSHOT_MAX_DELTAS=100`
@@ -57,6 +58,22 @@ Container/image mapping:
 
 The first snapshot refreshes live TA certificates before starting the RP process.
 
+## Resource Validation Mode
+
+New knob:
+
+```bash
+RESOURCE_VALIDATION_MODE=validation-update-03
+```
+
+Supported values:
+
+- `validation-update-03`: default behavior, using the current validation-update draft semantics;
+- `rfc6487`: switch back to the original RFC 6487 resource containment behavior.
+
+The installer / soak runner passes `--resource-validation-mode` to every `rpki` child start.
+When an upgraded deployment reuses an older `.env` that does not contain this key, the installer appends the new default `validation-update-03` automatically.
+
 ## Architecture Guardrails
 
 The key scripts read:

deploy/arm64-installer/docs/README.zh-CN.md

@@ -33,6 +33,7 @@ vim .env
 - `MAX_RUNS=-1`
 - `INTERVAL_SECS=600`
 - `TAL_INPUT_MODE=file-live-ta`
+- `RESOURCE_VALIDATION_MODE=validation-update-03`
 - `LIVE_TA_REFRESH_BEFORE_SNAPSHOT=1`
 - `PERIODIC_SNAPSHOT_RESET=0`
 - `PERIODIC_SNAPSHOT_MAX_DELTAS=100`
@@ -57,6 +58,22 @@ vim .env
 
 第一轮 snapshot 会先拉取 live TA，避免 clean state 使用旧 fixture TA。
 
+## 资源验证模式
+
+新增配置：
+
+```bash
+RESOURCE_VALIDATION_MODE=validation-update-03
+```
+
+可选值：
+
+- `validation-update-03`：默认，按当前 validation update draft 语义运行；
+- `rfc6487`：切换为 RFC 6487 原始资源包含判定语义。
+
+installer / soak runner 每次启动 `rpki` 子进程时都会显式传入 `--resource-validation-mode`。
+如果升级时复用旧 `.env` 且缺少该变量，installer 会自动补入默认值 `validation-update-03`，不会破坏旧 `.env` 复用流程。
+
 ## 架构检查
 
 关键脚本会读取：