add OpenBSD TA constraints and localhost TLS examples

tests/synthetic_docker_e2e.sh

@@ -47,6 +47,8 @@ fi
 run_validator() {
     local out="$1"
     local mode="$2"
+    local enabled="${3:-true}"
+    local policy="${4:-}"
     local config="$work_root/validate-$mode.toml"
     cat >"$config" <<EOF
 config-version = 1
@@ -54,6 +56,7 @@ mode = "validate"
 out = "/output"
 rrdp-state-dir = "/state"
 rrdp-sync-mode = "$mode"
+ta-constraints-enabled = $enabled
 ccr-out = "/output/result.ccr"
 http-timeout-secs = 5
 http-root-cert = ["/fixture/certs/rrdp-ca.pem"]
@@ -66,6 +69,7 @@ log-format = "json"
 id = "custom"
 tal = "/fixture/tal/custom.tal"
 ta = "/fixture/ta/custom-ta.cer"
+$policy
 EOF
     docker run --rm --network host --user "$(id -u):$(id -g)" \
         -v "$fixture:/fixture:ro" \
@@ -103,6 +107,29 @@ timing = json.loads((delta / "stage-timing.json").read_text(encoding="utf-8"))
 assert timing["analysis_counts"]["rrdp_delta_ops_applied_total"] > 0, timing
 PY
 
+# Policy changes must affect payloads even when RRDP is a noop.
+printf 'deny 0.0.0.0/0\ndeny ::/0\ndeny 0 - 4294967295\n' >"$fixture/tal/custom.constraints"
+mkdir -p "$work_root/output-denied" "$work_root/output-custom" "$work_root/output-disabled"
+run_validator "$work_root/output-denied" delta true
+printf 'allow 0.0.0.0/0\nallow ::/0\nallow 0 - 4294967295\n' >"$fixture/tal/allow.constraints"
+run_validator "$work_root/output-custom" delta true 'constraints = "/fixture/tal/allow.constraints"'
+printf 'malformed policy\n' >"$fixture/tal/custom.constraints"
+run_validator "$work_root/output-disabled" delta false 'constraints = "/fixture/tal/missing.constraints"'
+python3 - "$work_root" <<'PYTEST'
+import json, pathlib, sys
+root = pathlib.Path(sys.argv[1])
+for name, expected, enabled in [("denied", 0, True), ("custom", 2, True), ("disabled", 2, False)]:
+    out = root / f"output-{name}"
+    summary = json.loads((out / "summary.json").read_text())
+    assert summary["vrps"] == expected, summary
+    assert summary["taConstraintsEnabled"] == enabled, summary
+    assert len(summary["taConstraintsApplied"]) == int(enabled), summary
+    assert len((out / "vaps.csv").read_text().splitlines()) - 1 == (0 if name == "denied" else 1)
+    assert (out / "result-complete.json").exists()
+print("Constraints deny/custom/disabled payload checks passed with reused RRDP state")
+PYTEST
+rm "$fixture/tal/custom.constraints"
+
 echo "Synthetic Docker snapshot+delta E2E passed"
 
 # Exercise the actual public daemon in the image with a fresh protocol root.