build(compose): make root startup the default

scripts/test-default-compose.sh

@@ -0,0 +1,34 @@
+#!/bin/sh
+set -eu
+
+cd "$(dirname "$0")/.."
+
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' EXIT HUP INT TERM
+
+mkdir -p "$tmp/deploy/secrets" "$tmp/deploy/workspaces"
+cp compose.yaml "$tmp/compose.yaml"
+cp .env.example "$tmp/.env"
+printf '%s\n' 'THT_MODEL_API_KEY=example-secret' >"$tmp/deploy/secrets/thothii.secrets"
+chmod 0600 "$tmp/deploy/secrets/thothii.secrets"
+
+services=$(docker compose --project-directory "$tmp" config --services)
+[ "$services" = "core
+frontend" ] || {
+  echo "default Compose services must be core and frontend (got: $services)" >&2
+  exit 1
+}
+
+rendered=$(docker compose --project-directory "$tmp" config)
+printf '%s\n' "$rendered" | grep -q 'target: thothii.secrets'
+if printf '%s\n' "$rendered" | grep -Eq 'dwh_api_key|vector_reader_api_key|vector_writer_api_key|model_api_key|thoth_ca'; then
+  echo "default Compose must not declare legacy per-secret mounts" >&2
+  exit 1
+fi
+if printf '%s\n' "$rendered" | grep -Eq 'THT_[A-Z0-9_]+_SECRET_FILE:'; then
+  echo "default Compose must not require legacy secret-file variables" >&2
+  exit 1
+fi
+printf '%s\n' "$rendered" | grep -q 'THT_SECRETS_FILE: /run/secrets/thothii.secrets'
+
+echo "default Compose contract passed."