feat(perception): keep worker shadow local

tests/test_m4_worker_shadow_artifact.py

@@ -29,7 +29,7 @@ def _regular_files(archive: tarfile.TarFile) -> dict[str, bytes]:
     return result
 
 
-def test_worker_shadow_artifact_is_deterministic_narrow_and_data_only(
+def test_worker_shadow_artifact_is_deterministic_narrow_and_self_contained(
     tmp_path: Path,
 ) -> None:
     patch_id = "mission-core-m4-detector-shadow-unit-001"
@@ -52,6 +52,7 @@ def test_worker_shadow_artifact_is_deterministic_narrow_and_data_only(
         "manifest.env",
         "files.txt",
         "payload",
+        "payload/Invoke-M4DetectorShadow.ps1",
         "payload/m4-recorded-realtime-baseline-v1.json",
         "payload/mission-core-worker-shadow-v1.json",
         f"payload/{BUILDER.WHEEL_NAME}",
@@ -61,6 +62,7 @@ def test_worker_shadow_artifact_is_deterministic_narrow_and_data_only(
         == (f"id={patch_id}\ncomponent=mission-core-worker\ntype=shadow-release\n").encode()
     )
     assert regular["files.txt"].decode().splitlines() == list(BUILDER.PAYLOAD_FILES)
+    assert regular[f"payload/{BUILDER.RUNNER_NAME}"] == BUILDER.RUNNER.read_bytes()
     assert _sha256(regular[f"payload/{BUILDER.WHEEL_NAME}"]) == (BUILDER.EXPECTED_WHEEL_SHA256)
     assert _sha256(regular["payload/m4-recorded-realtime-baseline-v1.json"]) == (
         BUILDER.EXPECTED_BASELINE_SHA256
@@ -68,6 +70,12 @@ def test_worker_shadow_artifact_is_deterministic_narrow_and_data_only(
     descriptor = json.loads(regular["payload/mission-core-worker-shadow-v1.json"])
     assert descriptor["patch_id"] == patch_id
     assert descriptor["code_revision"] == first["code_revision"]
+    assert descriptor["boundary"] == {
+        "external_deploy_registry": False,
+        "nodedc_platform_repository": False,
+        "repository": "NODEDC_MISSION_CORE",
+        "server_docker_runtime": False,
+    }
     assert descriptor["container"]["public_ports"] is False
     assert descriptor["rollback"] == {
         "durable_worker_action": "none",