fix(worker): keep commit labels shell-safe

tests/test_observatory_worker_agent_image_artifact.py

@@ -69,6 +69,10 @@ def test_agent_dockerfile_is_offline_commit_bound_and_model_free() -> None:
     assert "org.opencontainers.image.revision=\"${NODEDC_SOURCE_REVISION}\"" in payload
     assert "com.nodedc.build-context.sha256=\"${NODEDC_BUILD_CONTEXT_SHA256}\"" in payload
     assert "com.nodedc.models=\"external\"" in payload
+    assert (
+        'org.opencontainers.image.title="NODE.DC-Observatory-Worker-006-agent"'
+        in payload
+    )
     assert f"PYTHONPATH=/opt/nodedc/mission-core/src:{DEPENDENCY_IMAGE_PATH}" in payload
     assert 'ENTRYPOINT ["python3", "-m", "k1link.observatory.m49_worker_container_main"]' in payload
     assert "CMD []" in payload

tests/test_worker_006_agent_image_installer.py

@@ -27,6 +27,11 @@ def test_worker_agent_installer_is_local_offline_and_non_buildkit() -> None:
     assert "--security-opt no-new-privileges" in script
     assert "target=/nodedc-build-source,readonly" in script
     assert "docker commit --pause=true @changes $containerId $tag" in script
+    assert (
+        "LABEL org.opencontainers.image.title="
+        "NODE.DC-Observatory-Worker-006-agent"
+    ) in script
+    assert 'title="NODE.DC Observatory Worker 006 agent"' not in script
     assert "docker rm -f $containerId" in script
     assert "docker rm -f $containerName" not in script