fix(worker): keep commit labels shell-safe

experiments/perception/worker/observatory_portable/Dockerfile.worker-006-agent

@@ -72,7 +72,7 @@ RUN mkdir -p /run/nodedc/registries \
     && find /opt/nodedc/mission-core -type f -exec chmod 0444 {} + \
     && python3 -c "import k1link.observatory.m49_worker_container_main as entrypoint; import k1link.observatory.m49_worker_service as composition; assert callable(entrypoint.main); assert callable(composition.compose_installed_m49_worker_service)"
 
-LABEL org.opencontainers.image.title="NODE.DC Observatory Worker 006 agent" \
+LABEL org.opencontainers.image.title="NODE.DC-Observatory-Worker-006-agent" \
       org.opencontainers.image.source="NODEDC_MISSION_CORE" \
       org.opencontainers.image.revision="${NODEDC_SOURCE_REVISION}" \
       com.nodedc.product="mission-core" \

experiments/perception/worker/observatory_portable/Install-Worker006AgentImage.ps1

@@ -537,7 +537,7 @@ function Assert-ImageContract {
         [int64]$DependencyManifest.byte_length
     ).ToString([Globalization.CultureInfo]::InvariantCulture)
     $expectedLabels = [ordered]@{
-        "org.opencontainers.image.title" = "NODE.DC Observatory Worker 006 agent"
+        "org.opencontainers.image.title" = "NODE.DC-Observatory-Worker-006-agent"
         "org.opencontainers.image.source" = "NODEDC_MISSION_CORE"
         "org.opencontainers.image.revision" = $SourceRevision
         "com.nodedc.product" = "mission-core"
@@ -1061,7 +1061,7 @@ try {
                 "--change", "USER 0:0",
                 "--change", "ENTRYPOINT $ImageEntrypoint",
                 "--change", "CMD $ImageCommand",
-                "--change", 'LABEL org.opencontainers.image.title="NODE.DC Observatory Worker 006 agent"',
+                "--change", "LABEL org.opencontainers.image.title=NODE.DC-Observatory-Worker-006-agent",
                 "--change", "LABEL org.opencontainers.image.source=NODEDC_MISSION_CORE",
                 "--change", "LABEL org.opencontainers.image.revision=$SourceRevision",
                 "--change", "LABEL com.nodedc.product=mission-core",

tests/test_observatory_worker_agent_image_artifact.py

@@ -69,6 +69,10 @@ def test_agent_dockerfile_is_offline_commit_bound_and_model_free() -> None:
     assert "org.opencontainers.image.revision=\"${NODEDC_SOURCE_REVISION}\"" in payload
     assert "com.nodedc.build-context.sha256=\"${NODEDC_BUILD_CONTEXT_SHA256}\"" in payload
     assert "com.nodedc.models=\"external\"" in payload
+    assert (
+        'org.opencontainers.image.title="NODE.DC-Observatory-Worker-006-agent"'
+        in payload
+    )
     assert f"PYTHONPATH=/opt/nodedc/mission-core/src:{DEPENDENCY_IMAGE_PATH}" in payload
     assert 'ENTRYPOINT ["python3", "-m", "k1link.observatory.m49_worker_container_main"]' in payload
     assert "CMD []" in payload

tests/test_worker_006_agent_image_installer.py

@@ -27,6 +27,11 @@ def test_worker_agent_installer_is_local_offline_and_non_buildkit() -> None:
     assert "--security-opt no-new-privileges" in script
     assert "target=/nodedc-build-source,readonly" in script
     assert "docker commit --pause=true @changes $containerId $tag" in script
+    assert (
+        "LABEL org.opencontainers.image.title="
+        "NODE.DC-Observatory-Worker-006-agent"
+    ) in script
+    assert 'title="NODE.DC Observatory Worker 006 agent"' not in script
     assert "docker rm -f $containerId" in script
     assert "docker rm -f $containerName" not in script