fix: finalize durable Pi lifecycle

tools/thothctl/internal/config/installation.go

@@ -101,6 +101,13 @@ func Load(path string) (Installation, error) {
 			return Installation{}, err
 		}
 	}
+	if info, err := os.Lstat(installation.CurrentImageOverridePath()); err == nil {
+		if !info.Mode().IsRegular() {
+			return Installation{}, errors.New("installation current-image override must be a regular file")
+		}
+	} else if !errors.Is(err, os.ErrNotExist) {
+		return Installation{}, errors.New("installation current-image override could not be inspected")
+	}
 	return installation, nil
 }
 
@@ -111,7 +118,26 @@ func (i Installation) ComposeFiles() []string {
 		filepath.Join(i.ProjectDirectory, "compose.yaml"),
 		filepath.Join(i.ProjectDirectory, "deploy", "compose."+i.Profile+".yaml"),
 	}
-	return append(files, i.Overrides...)
+	files = append(files, i.Overrides...)
+	currentImage := i.CurrentImageOverridePath()
+	if info, err := os.Lstat(currentImage); err == nil && info.Mode().IsRegular() {
+		files = append(files, currentImage)
+	}
+	return files
+}
+
+// ControlDirectory contains state that is private to one installation descriptor, even when
+// multiple installations intentionally share one source checkout.
+func (i Installation) ControlDirectory() string {
+	return filepath.Join(i.ProjectDirectory, ".thothctl", i.ProjectName())
+}
+
+func (i Installation) CurrentImageOverridePath() string {
+	return filepath.Join(i.ControlDirectory(), "current-image.yaml")
+}
+
+func (i Installation) UpdateStatePath() string {
+	return filepath.Join(i.ControlDirectory(), "update-state.json")
 }
 
 // ProjectName is stable for one installation and avoids collisions between different checkouts.
@@ -168,9 +194,13 @@ func (i Installation) SecretFiles() ([]string, error) {
 // callers. It is used only for operator-visible file locations, never for secret content.
 func (i Installation) EnvironmentValue(name string) (string, error) {
 	contents, err := safeio.ReadCanonicalRegular(i.EnvFile, maxEnvironmentFileBytes)
-	if err != nil { return "", errors.New("installation environment could not be read") }
+	if err != nil {
+		return "", errors.New("installation environment could not be read")
+	}
 	values, err := parseComposeDotenv(contents)
-	if err != nil { return "", errors.New("installation environment could not be read") }
+	if err != nil {
+		return "", errors.New("installation environment could not be read")
+	}
 	return values[name], nil
 }