fix(worker): mount generated shell scripts

tests/test_observatory_worker_agent_image_artifact.py

@@ -272,6 +272,26 @@ def test_install_plan_requires_offline_build_hardening_smoke_and_unfilled_receip
         "runtime_bind_allowed": False,
         "network_install_allowed": False,
     }
+    shell_scripts = cast(dict[str, object], build["temporary_shell_scripts"])
+    assert shell_scripts == {
+        "encoding": "utf-8",
+        "byte_order_mark": False,
+        "line_endings": "lf",
+        "identity_verification": (
+            "SHA-256 and byte length before and after container use"
+        ),
+        "host_cleanup": "always",
+        "build": {
+            "container_path": "/nodedc-build-script.sh",
+            "mount": "read-only",
+            "invocation": ["/bin/sh", "/nodedc-build-script.sh"],
+        },
+        "installed_image_smoke": {
+            "container_path": "/nodedc-smoke-script.sh",
+            "mount": "read-only",
+            "invocation": ["/bin/sh", "/nodedc-smoke-script.sh"],
+        },
+    }
     base = cast(dict[str, object], build["base_image"])
     assert base["reference"] == BASE_REFERENCE
     assert base["sha256"] == BASE_SHA256
@@ -358,6 +378,7 @@ def test_install_plan_requires_offline_build_hardening_smoke_and_unfilled_receip
     assert smoke["network"] == "none"
     assert smoke["read_only_rootfs"] is True
     assert smoke["platform"] == "linux/amd64"
+    assert smoke["entrypoint"] == ["/bin/sh", "/nodedc-smoke-script.sh"]
     assert smoke["staged_source_bytes"] == "matched"
     assert smoke["embedded_context_bytes"] == "matched"
     assert smoke["embedded_snapshot_manifest"] == "matched"

tests/test_worker_006_agent_image_installer.py

@@ -42,6 +42,26 @@ def test_worker_agent_installer_is_local_offline_and_non_buildkit() -> None:
     assert "smb" not in lowered
 
 
+def test_worker_agent_installer_mounts_utf8_lf_shell_scripts_by_file() -> None:
+    script = _script()
+
+    assert "function New-TemporaryShellScript" in script
+    assert '$Content.Replace("`r`n", "`n").Replace("`r", "`n")' in script
+    assert "New-Object Text.UTF8Encoding($false)" in script
+    assert "[IO.File]::ReadAllBytes($item.FullName)" in script
+    assert "$bytes[$bytes.Length - 1] -ne 10" in script
+    assert "$bytes -contains 13" in script
+    assert script.count("Assert-TemporaryShellScriptIdentity") == 5
+    assert 'New-TemporaryShellScript "build" $copyScriptContent' in script
+    assert 'New-TemporaryShellScript "smoke" $smokeScriptContent' in script
+    assert "target=/nodedc-build-script.sh,readonly" in script
+    assert "target=/nodedc-smoke-script.sh,readonly" in script
+    assert "$BaseImageReference `\n                    /nodedc-build-script.sh" in script
+    assert "$Tag `\n            /nodedc-smoke-script.sh" in script
+    assert "-c $copyScript" not in script
+    assert "-c $smokeScript" not in script
+
+
 def test_worker_agent_installer_separates_archive_and_staged_identities() -> None:
     script = _script()
 
@@ -222,6 +242,8 @@ def test_worker_agent_installer_removes_failed_new_image_and_temporary_files() -
     assert "image verification failed and committed image cleanup failed" in script
     assert "Remove-Item -LiteralPath $embeddedManifest.path -Force" in script
     assert "Remove-Item -LiteralPath $dependencyManifest.path -Force" in script
+    assert "Remove-Item -LiteralPath $buildScriptFile.path -Force" in script
+    assert "Remove-Item -LiteralPath $smokeScriptFile.path -Force" in script
 
 
 def test_worker_agent_installer_seals_runtime_contract_smoke_and_output() -> None: