Run a disposable Jenkins controller by image digest, verify loopback HTTP readiness and recreate it against the same volume without logging the initial password.
Stop a lab controller, exclude master.key from its archive, restore that key separately and check a new-volume startup, marker and initial-password persistence.