feat: thothctl workspace preprocessing CLI and file-ingress contracts (P2)

tools/thothctl/internal/pi/update.go

@@ -743,7 +743,12 @@ func writeLifecycleOverride(path, image string) error {
 	if err != nil {
 		return errors.New("lifecycle image override could not be encoded")
 	}
-	contents := []byte("services:\n  core:\n    image: " + string(quoted) + "\n")
+	contents := []byte(`services:
+  core:
+    image: ` + string(quoted) + `
+  workspace-maintenance:
+    image: ` + string(quoted) + `
+`)
 	if err := writeFileDurably(path, ".pi-lifecycle-", contents); err != nil {
 		return errors.New("lifecycle image override could not be written durably")
 	}

tools/thothctl/internal/pi/update_test.go

@@ -126,6 +126,24 @@ func TestSuccessfulUpdateAndRollbackRemainSelectedOnFreshRecreate(t *testing.T)
 	}
 }
 
+func TestWriteLifecycleOverridePinsCoreAndWorkspaceMaintenanceToTheSameImage(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "current-image.yaml")
+	if err := writeLifecycleOverride(path, "sha256:"+strings.Repeat("a", 64)); err != nil {
+		t.Fatal(err)
+	}
+	contents, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	text := string(contents)
+	wantedImage := `image: "sha256:` + strings.Repeat("a", 64) + `"`
+	for _, expected := range []string{"services:", "core:", "workspace-maintenance:", wantedImage} {
+		if !strings.Contains(text, expected) {
+			t.Fatalf("override = %q, missing %q", text, expected)
+		}
+	}
+}
+
 func TestSelectorPromotionDoesNotMaskPostRenameDirectoryFsyncFailure(t *testing.T) {
 	directory := t.TempDir()
 	source := filepath.Join(directory, "candidate.yaml")