Add CLI helper for entropy volume

tests/mount_entropy.bats

@@ -0,0 +1,25 @@
+#!/usr/bin/env bats
+# Seam: the entropy helper unlocks the known LUKS-on-md device and mounts via
+# the host's fstab entry, preserving the existing mount options and directory
+# ownership rather than inventing a second mount configuration.
+
+load helpers
+
+@test "entropy helper is executable and has the expected safe shell shape" {
+    run bash -c "test -x '$REPO_ROOT/scripts/mount-entropy.sh'"
+    [ "$status" -eq 0 ]
+
+    run grep -E '^set -euo pipefail$' "$REPO_ROOT/scripts/mount-entropy.sh"
+    [ "$status" -eq 0 ]
+
+    run grep -F 'udisksctl unlock --block-device /dev/md0' "$REPO_ROOT/scripts/mount-entropy.sh"
+    [ "$status" -eq 0 ]
+
+    run grep -F 'sudo mount "$MOUNTPOINT"' "$REPO_ROOT/scripts/mount-entropy.sh"
+    [ "$status" -eq 0 ]
+}
+
+@test "entropy helper does not embed a secret or alter mount ownership" {
+    run grep -Eiq 'password|secret|chmod|chown' "$REPO_ROOT/scripts/mount-entropy.sh"
+    [ "$status" -eq 1 ]
+}