fix(worker): preserve transport patch in Docker snapshot layers

experiments/perception/worker/observatory_portable/migrate_claim_transport_v3.py

@@ -234,9 +234,15 @@ def build_transport(engine: Engine, name: str, parent: str, script_sha: str) ->
                 "name": name + "-claim-v3-layer",
             }
         ),
-        {"Image": "sha256:" + parent, "HostConfig": {"NetworkMode": "none"}},
+        {"Image": "sha256:" + parent, "Entrypoint": ["/bin/true"], "Cmd": [],
+         "HostConfig": {"NetworkMode": "none", "CapDrop": ["ALL"], "PidsLimit": 32,
+                        "SecurityOpt": ["no-new-privileges"]}},
     )["Id"]
     try:
+        # Initialize the layer with a network-free CPU no-op, never the agent CMD.
+        engine.request("POST", f"/containers/{temporary}/start")
+        if engine.request("POST", f"/containers/{temporary}/wait")["StatusCode"] != 0:
+            raise RuntimeError("offline image-layer initialization failed")
         archive = engine.request(
             "GET", f"/containers/{temporary}/archive?" + urlencode({"path": SOURCE}), raw=True
         )
@@ -249,6 +255,9 @@ def build_transport(engine: Engine, name: str, parent: str, script_sha: str) ->
         replacement = patch_source(original)
         member.name = Path(SOURCE).name
         member.size = len(replacement)
+        # Same-length v2 -> v3 bytes must not retain the original file timestamp:
+        # metadata-based snapshotters can otherwise omit the changed content.
+        member.mtime = max(int(time.time()), int(member.mtime) + 1)
         member.pax_headers = {}
         data = io.BytesIO()
         with tarfile.open(fileobj=data, mode="w") as output:
@@ -266,7 +275,9 @@ def build_transport(engine: Engine, name: str, parent: str, script_sha: str) ->
         changes = engine.request("GET", f"/containers/{temporary}/changes")
         allowed = {str(path) for path in Path(SOURCE).parents} | {SOURCE}
         if not changes or any(item["Kind"] != 0 or item["Path"] not in allowed for item in changes):
-            raise ValueError("transport layer changed files outside the reviewed source")
+            raise ValueError(
+                f"transport layer changed files outside the reviewed source: {changes!r}"
+            )
         original_image = engine.request("GET", f"/images/sha256:{parent}/json")
         config = copy.deepcopy(original_image["Config"])
         config.setdefault("Labels", {}).update(