test-kitchen: fix Berksfiles and the rskj pin; document open tasks

- kosmos_email: add the missing Berksfile so its declared dependencies
  (hostname/unbound/postfix) resolve
- kosmos_garage: add local path deps for the internal cookbooks so
  Berkshelf stops fetching them from Supermarket
- kosmos_rsk: bump rskj to 9.0.4~<codename> (current ppa:rsksmart/rskj
  build) and update the matching InSpec assertion; suite now passes 9/9
- document the remaining suite work in doc/test-kitchen-open-tasks.md

doc/test-kitchen-open-tasks.md

@@ -0,0 +1,60 @@
+# Test Kitchen: open tasks
+
+Status of the Test Kitchen integration suites after the migration to Cinc
+Workstation. Suites are run with Cinc Workstation's bundled `kitchen`
+(`kitchen-dokken` 2.25.0), which provisions Cinc Client via
+`provisioner: product_name: cinc`.
+
+## Suites with tests
+
+| Cookbook | Test | Berksfile | State |
+| --- | --- | --- | --- |
+| `kosmos-ejabberd` | `test/integration/default` | complete (path + pinned deps) | untested |
+| `kosmos_email` | `test/integration/default` | added | not green yet |
+| `kosmos_garage` | `test/integration/default` | fixed (local path deps) | untested |
+| `kosmos_rsk` | `test/integration/rskj` | complete | green (verified) |
+
+## Suites without tests
+
+`kosmos_liquor-cabinet` and `liquor_cabinet` declare
+`verifier.inspec_tests: test/integration/default`, but that directory does not
+exist. Either add real InSpec tests or remove the `inspec_tests` entries.
+
+## Fixes applied during the migration
+
+- Cinc provisioning verified: `kosmos_rsk` and `kosmos_email` both reached a
+  running `cinc-client 18.2.7` inside Dokken (no Chef license prompt).
+- `kosmos_rsk` suite passes end to end (9/9) after the fixes below, confirming
+  the Cinc Workstation → `kitchen-dokken` 2.25 → `product_name: cinc` pipeline.
+- `kosmos_email`: added a `Berksfile` (there was none, so declared dependencies
+  like `hostname` could not resolve).
+- `kosmos_garage`: added local `path:` dependencies
+  (`kosmos_openresty`, `kosmos-base`, `openresty`, `kosmos-postfix`) so Berkshelf
+  no longer tries to fetch internal cookbooks from Supermarket.
+- `kosmos_rsk`: bumped the `rskj` pin from `9.0.1~<codename>` to
+  `9.0.4~<codename>` (matching the current version in `ppa:rsksmart/rskj`), and
+  updated the matching assertion in `test/integration/rskj/rskj_test.rb`.
+
+## Remaining tasks
+
+1. **`kosmos_email` is not green yet.** Even with the Berksfile, the default
+   recipe pulls in a lot (`unbound`, `opendkim`, `spamassassin`, `postfix`,
+   `dovecot`, `tls_cert_for` from `kosmos-base`, firewall rules). It likely needs
+   a reduced/lifecycle setup before it converges in Dokken.
+2. **`kosmos_garage`** has not been run since the Berksfile fix; it uses
+   Ubuntu 20.04 and needs its data bag secret.
+3. **`kosmos-ejabberd`** is untested. It has the most complete Berksfile and a
+   `pre_converge` lifecycle that prepares PostgreSQL, so it is the most likely
+   suite to pass — worth doing next.
+4. **Liquor suites**: add tests or drop the dangling `inspec_tests`.
+5. **Benign warning**: knife-zero double-loads `knife ssh` under knife 19,
+   printing `already initialized constant Chef::Knife::Ssh::SUDO_PASSWORD_PROMPT`.
+   Harmless; would need an upstream knife-zero fix to silence.
+
+## Notes
+
+- Suites live in `site-cookbooks/<name>/kitchen.yml`; run them with
+  `kitchen test` from that directory (Cinc Workstation must be on the PATH, see
+  the repository `README.md`).
+- Five cookbooks are git submodules (`blossom`, `deno`, `openresty`,
+  `postgresql`, `strfry`); their suites would need changes in their own repos.

site-cookbooks/kosmos_email/Berksfile

@@ -0,0 +1,16 @@
+source 'https://supermarket.chef.io'
+
+# community cookbooks pinned to the versions vendored for production (see the
+# root Berksfile.lock), so the integration suite exercises the same cookbook set
+cookbook 'firewall', '= 6.2.16'
+cookbook 'hostname', '= 0.4.2'
+cookbook 'unbound', '~> 3.0.2'
+cookbook 'postfix',
+  git: 'https://gitea.kosmos.org/kosmos/postfix-cookbook.git',
+  ref: 'bugfix/sasl_attributes'
+
+# local cookbooks
+cookbook 'kosmos-base', path: '../kosmos-base'
+cookbook 'kosmos-postfix', path: '../kosmos-postfix'
+
+metadata

site-cookbooks/kosmos_garage/Berksfile

@@ -1,3 +1,9 @@
 source 'https://supermarket.chef.io'
 
+# local cookbooks
+cookbook 'kosmos_openresty', path: '../kosmos_openresty'
+cookbook 'kosmos-base', path: '../kosmos-base'
+cookbook 'openresty', path: '../openresty'
+cookbook 'kosmos-postfix', path: '../kosmos-postfix'
+
 metadata

site-cookbooks/kosmos_rsk/attributes/default.rb

@@ -1,4 +1,4 @@
-node.default['rskj']['version'] = "9.0.1~#{node['lsb']['codename']}"
+node.default['rskj']['version'] = "9.0.4~#{node['lsb']['codename']}"
 node.default['rskj']['network'] = 'testnet'
 
 node.default['rskj']['nginx']['domain'] = nil

site-cookbooks/kosmos_rsk/test/integration/rskj/rskj_test.rb

@@ -9,7 +9,7 @@ end
 
 describe package('rskj') do
   it { should be_installed }
-  its('version') { should eq '9.0.1~noble' }
+  its('version') { should eq '9.0.4~noble' }
 end
 
 describe service('rsk') do