Eject Phase 1: Inventory & Dry-Run

Parent: #206

Summary

Implement ptd eject <target> --dry-run to produce a complete artifact bundle without changing any infrastructure. This is immediately useful for support/sales customer conversations before severance (Phase 2) is built.

Artifact Bundle Structure

eject-<target>/
├── README.pdf
├── config/
│   ├── ptd.yaml
│   ├── site_*/site.yaml
│   └── customizations/
├── state/
│   ├── pulumi-exports/
│   └── resource-inventory.json
├── secrets/
│   └── secret-references.json
├── runbooks/
│   ├── day-to-day-ops.md
│   ├── disaster-recovery.md
│   └── observability.md
└── metadata.json

Validation

• Run ptd eject <target> --dry-run and review the full bundle
• Have someone unfamiliar with the workload read the PDF — does it make sense standalone?
• Verify resource-inventory.json contains all expected resources
• Spot-check secret references against actual Secrets Manager entries

Start with the ptd eject <target> --dry-run command and its existing target, configuration, state, and secret-handling entry points. Generate and review the complete artifact bundle described in the issue, then verify that resource-inventory.json includes expected resources and secret references match Secrets Manager entries without changing infrastructure.