Make in-place upgrade from HashiCorp Boundary seamless

Linux packages: migrate /etc/boundary.d to /etc/threshold.d without
clobbering, reuse the boundary service user, carry over service
enablement with a boundary.service alias, provide a boundary command.
Docker: accept /boundary/config.hcl, boundary command, /boundary symlink.
CLI: deprecation notice when invoked as boundary (stderr only).
Dev mode: also create *.threshold.dev aliases.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

.release/docker/test-entrypoint.sh

@@ -0,0 +1,107 @@
+#!/bin/bash
+# Self-contained test for the legacy-path handling in docker-entrypoint.sh.
+#
+# Runs the real entrypoint with a fake "threshold" binary and temporary
+# config paths (via the THRESHOLD_ENTRYPOINT_TEST_* overrides). No Docker or
+# root needed. The entrypoint is written for busybox/ash; bash is used here
+# because it accepts the same ${var:off:len} syntax.
+#
+# Usage: .release/docker/test-entrypoint.sh
+
+set -u
+
+HERE=$(cd "$(dirname "$0")" && pwd)
+ENTRY="$HERE/docker-entrypoint.sh"
+WORK=$(mktemp -d)
+trap 'rm -rf "$WORK"' EXIT
+
+FAILS=0
+PASSES=0
+check() { # check DESC EXPECTED ACTUAL
+	if [ "$2" = "$3" ]; then
+		PASSES=$((PASSES + 1))
+	else
+		FAILS=$((FAILS + 1))
+		echo "FAIL: $1" >&2
+		echo "  expected: $2" >&2
+		echo "  actual:   $3" >&2
+	fi
+}
+
+mkdir -p "$WORK/bin" "$WORK/new" "$WORK/legacy"
+# Fake threshold: print the argument vector on one line, "|"-separated.
+cat >"$WORK/bin/threshold" <<'EOF'
+#!/bin/sh
+case "$1" in --help) [ "$2" = threshold ] || echo "threshold $2"; exit 0 ;; esac
+IFS='|'
+echo "ARGS:$*"
+EOF
+cat >"$WORK/bin/su-exec" <<'EOF'
+#!/bin/sh
+shift
+exec "$@"
+EOF
+chmod 755 "$WORK/bin/threshold" "$WORK/bin/su-exec"
+
+NEWCFG="$WORK/new/config.hcl"
+LEGCFG="$WORK/legacy/config.hcl"
+STOCK="$WORK/stock.hcl"
+
+run() { # run ARGS... ; prints "<stdout-args> || <stderr>"
+	PATH="$WORK/bin:$PATH" SKIP_CHOWN=1 SKIP_SETCAP=1 \
+		THRESHOLD_ENTRYPOINT_TEST_NEW="$NEWCFG" \
+		THRESHOLD_ENTRYPOINT_TEST_LEGACY="$LEGCFG" \
+		THRESHOLD_ENTRYPOINT_TEST_STOCK="$STOCK" \
+		bash "$ENTRY" "$@" 2>"$WORK/err" | grep '^ARGS:'
+}
+stderr() { cat "$WORK/err"; }
+
+echo "stock demo config" >"$STOCK"
+cp "$STOCK" "$NEWCFG"
+
+# 1. default invocation, stock config, no legacy file -> unchanged, no warning
+out=$(run server -config "$NEWCFG")
+check "default path kept" "ARGS:server|-config|$NEWCFG" "$out"
+check "no warning by default" "" "$(stderr | grep -c deprecated | grep -v '^0$')"
+
+# 2. user's own /threshold config (differs from stock) wins over a legacy file
+echo "user threshold config" >"$NEWCFG"
+echo "user legacy config" >"$LEGCFG"
+out=$(run server -config "$NEWCFG")
+check "custom threshold config preferred" "ARGS:server|-config|$NEWCFG" "$out"
+
+# 3. stock /threshold config + user legacy config -> legacy used with warning
+cp "$STOCK" "$NEWCFG"
+out=$(run server -config "$NEWCFG")
+check "legacy config used when threshold is stock" "ARGS:server|-config|$LEGCFG" "$out"
+check "deprecation warning printed" "1" "$(stderr | grep -c 'WARNING.*Boundary-era')"
+
+# 4. explicit legacy path that exists -> used with warning
+out=$(run server -config "$LEGCFG")
+check "explicit legacy path kept" "ARGS:server|-config|$LEGCFG" "$out"
+check "explicit legacy warns" "1" "$(stderr | grep -c 'WARNING')"
+
+# 5. explicit legacy path that does not exist -> fall back to threshold path
+rm -f "$LEGCFG"
+out=$(run server -config "$LEGCFG")
+check "missing legacy falls back to threshold" "ARGS:server|-config|$NEWCFG" "$out"
+
+# 6. -config=PATH form
+echo "user legacy config" >"$LEGCFG"
+out=$(run server -config="$LEGCFG")
+check "-config=path form" "ARGS:server|-config=$LEGCFG" "$out"
+rm -f "$LEGCFG"
+out=$(run server -config="$LEGCFG")
+check "-config=path fallback" "ARGS:server|-config=$NEWCFG" "$out"
+
+# 7. legacy command name
+out=$(run boundary version)
+check "boundary command accepted" "ARGS:version" "$out"
+check "boundary command warns" "1" "$(stderr | grep -c "'boundary' command is deprecated")"
+
+# 8. unrelated args untouched
+out=$(run database init -config "$NEWCFG" -skip-auth-method-creation)
+check "other args preserved" "ARGS:database|init|-config|$NEWCFG|-skip-auth-method-creation" "$out"
+
+echo "passed: $PASSES, failed: $FAILS"
+[ "$FAILS" -eq 0 ]