feat: thothctl workspace preprocessing CLI and file-ingress contracts (P2)

tools/thothctl/internal/pi/update_test.go

@@ -126,6 +126,24 @@ func TestSuccessfulUpdateAndRollbackRemainSelectedOnFreshRecreate(t *testing.T)
 	}
 }
 
+func TestWriteLifecycleOverridePinsCoreAndWorkspaceMaintenanceToTheSameImage(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "current-image.yaml")
+	if err := writeLifecycleOverride(path, "sha256:"+strings.Repeat("a", 64)); err != nil {
+		t.Fatal(err)
+	}
+	contents, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	text := string(contents)
+	wantedImage := `image: "sha256:` + strings.Repeat("a", 64) + `"`
+	for _, expected := range []string{"services:", "core:", "workspace-maintenance:", wantedImage} {
+		if !strings.Contains(text, expected) {
+			t.Fatalf("override = %q, missing %q", text, expected)
+		}
+	}
+}
+
 func TestSelectorPromotionDoesNotMaskPostRenameDirectoryFsyncFailure(t *testing.T) {
 	directory := t.TempDir()
 	source := filepath.Join(directory, "candidate.yaml")