fix(worker): preserve transport patch in Docker snapshot layers

tests/test_observatory_claim_transport_migration.py

@@ -2,7 +2,9 @@ from __future__ import annotations
 
 import copy
 import importlib.util
+import io
 import json
+import tarfile
 from pathlib import Path
 
 import pytest
@@ -127,3 +129,53 @@ def test_changed_plan_cannot_write_evidence_or_touch_containers(
     with pytest.raises(ValueError, match="plan changed"):
         migration.apply(object(), "0" * 64, evidence)
     assert not evidence.exists()
+
+
+def test_image_layer_refreshes_mtime_and_retains_exact_parent(monkeypatch) -> None:
+    source = b'PROTOCOL = "missioncore.observatory-worker-claim-request/v2"\n'
+    monkeypatch.setattr(migration, "BEFORE_SHA", migration.sha(source))
+    archive = io.BytesIO()
+    with tarfile.open(fileobj=archive, mode="w") as output:
+        member = tarfile.TarInfo("worker_http_transport.py")
+        member.size = len(source)
+        member.mtime = 123
+        output.addfile(member, io.BytesIO(source))
+
+    class FakeEngine:
+        removed = False
+
+        def request(self, method, path, body=None, *, raw=False):
+            if path.startswith("/containers/create"):
+                assert body["Entrypoint"] == ["/bin/true"]
+                assert body["HostConfig"]["NetworkMode"] == "none"
+                return {"Id": "temporary"}
+            if path.endswith("/start"):
+                return None
+            if path.endswith("/wait"):
+                return {"StatusCode": 0}
+            if "/archive?" in path:
+                if method == "GET":
+                    return archive.getvalue()
+                with tarfile.open(fileobj=io.BytesIO(body)) as uploaded:
+                    patched = uploaded.getmembers()[0]
+                    assert patched.mtime > 123
+                    assert uploaded.extractfile(patched).read() == source.replace(
+                        migration.OLD, migration.NEW
+                    )
+                return None
+            if path.endswith("/changes"):
+                return [{"Kind": 0, "Path": migration.SOURCE}]
+            if path == "/images/sha256:parent/json":
+                return {"Config": {"Labels": {}}, "RootFS": {"Layers": ["base"]}}
+            if path.startswith("/commit?"):
+                assert body["Labels"][migration.PARENT_LABEL] == "parent"
+                return {"Id": "sha256:new"}
+            if path == "/images/sha256:new/json":
+                return {"RootFS": {"Layers": ["base", "transport-only"]}}
+            assert method == "DELETE" and path == "/containers/temporary"
+            self.removed = True
+
+    engine = FakeEngine()
+    result = migration.build_transport(engine, "ndc-test-agent", "parent", "script")
+    assert result["image"] == "sha256:new"
+    assert engine.removed