fix(worker): compose staged source paths safely

experiments/perception/worker/observatory_portable/Install-Worker006AgentImage.ps1

@@ -119,9 +119,9 @@ function Get-StagedSnapshotInspection {
     $manifestPath = Join-Path $Root ($ContextManifestRelativePath.Replace("/", "\"))
     $dockerfilePath = Join-Path $Root ($DockerfileRelativePath.Replace("/", "\"))
     $requiredSourceFiles = @(
-        Join-Path $sourceRoot "__init__.py",
-        Join-Path $sourceRoot "observatory\m49_worker_container_main.py",
-        Join-Path $sourceRoot "observatory\m49_worker_service.py"
+        (Join-Path $sourceRoot "__init__.py")
+        (Join-Path $sourceRoot "observatory\m49_worker_container_main.py")
+        (Join-Path $sourceRoot "observatory\m49_worker_service.py")
     )
     foreach ($requiredPath in $requiredSourceFiles + @($manifestPath, $dockerfilePath)) {
         if (-not (Test-Path -LiteralPath $requiredPath -PathType Leaf)) {

tests/test_worker_006_agent_image_installer.py

@@ -62,6 +62,15 @@ def test_worker_agent_installer_separates_archive_and_staged_identities() -> Non
     assert 'canonicalization = "utf8-path-nul-length-nul-sha256-lf-v1"' in script
     assert 'Assert-ExactDirectoryChildren $Root @("experiments", "src")' in script
     assert 'Assert-ExactDirectoryChildren $srcRoot @("k1link")' in script
+    assert '(Join-Path $sourceRoot "__init__.py")' in script
+    assert (
+        '(Join-Path $sourceRoot "observatory\\m49_worker_container_main.py")'
+        in script
+    )
+    assert (
+        '(Join-Path $sourceRoot "observatory\\m49_worker_service.py")'
+        in script
+    )
     assert "Dockerfile.worker-006-agent" in script
     assert "worker-006-agent-build-context.json" in script
     assert (