fix(ci): pin maintenance smoke image

scripts/test-task13-runtime-fixtures.sh

@@ -77,6 +77,18 @@ rendered="$fixture/rendered.json"
 docker compose --project-name "$TASK13_PROJECT" --project-directory "$root" \
   --env-file "$TASK13_ENV_FILE" "${compose_files[@]}" config --format json >"$rendered"
 task13_assert_rendered_contract
+maintenance_rendered="$fixture/maintenance-rendered.json"
+docker compose --project-name "$TASK13_PROJECT" --project-directory "$root" \
+  --env-file "$TASK13_ENV_FILE" "${compose_files[@]}" --profile workspace-maintenance \
+  config --format json >"$maintenance_rendered"
+node - "$maintenance_rendered" <<'NODE'
+const config = JSON.parse(require("fs").readFileSync(process.argv[2], "utf8"));
+const core = config.services?.core;
+const maintenance = config.services?.["workspace-maintenance"];
+if (!core || !maintenance || maintenance.image !== core.image) {
+  throw new Error("workspace-maintenance must use the isolated core image");
+}
+NODE
 tsx_loader="$root/backend/node_modules/tsx/dist/loader.mjs"
 checker=(node --import "$tsx_loader" "$root/scripts/task13-runtime-fixture-check.ts")
 [[ -f "$tsx_loader" ]] || {

scripts/unified-deployment-smoke.sh

@@ -504,6 +504,11 @@ services:
       - application-secrets:/run/secrets:ro
       - registry-remote:/fixtures/remote.git:ro
     secrets: !reset []
+  workspace-maintenance:
+    image: $TASK13_CORE_IMAGE
+    pull_policy: never
+    labels:
+      io.thothii.task13.run: "$TASK13_RUN_ID"
   frontend:
     image: $TASK13_FRONTEND_IMAGE
     build:
@@ -704,6 +709,11 @@ services:
       - $remote_path:/fixtures/remote.git:ro
       - $TASK13_SESSION_RUNTIME_PASSWORD:/run/secrets/task13-runtime-password:ro
       - $TASK13_OIDC_CERT:/fixtures/task13-oidc-ca.pem:ro
+  workspace-maintenance:
+    image: $TASK13_CORE_IMAGE
+    pull_policy: never
+    labels:
+      io.thothii.task13.run: "$TASK13_RUN_ID"
   frontend:
     image: $TASK13_FRONTEND_IMAGE
     build: