feat: profile-gated workspace-maintenance service and connector override generator (P2)

compose.yaml

@@ -55,6 +55,60 @@ services:
     networks:
       - thothii
 
+  workspace-maintenance:
+    image: thothii-core:local
+    profiles: [workspace-maintenance]
+    pull_policy: never
+    entrypoint: ["/usr/bin/tini", "--", "/app/docker/workspace-maintenance-entrypoint.sh"]
+    environment:
+      THT_HARNESS_DIR: /app/harness
+      THT_BIN: /opt/venv/bin/tht
+      THT_DATA_ROOT: /data
+      THT_WORKSPACE_REGISTRY_ROOT: /data/workspace-registry
+      THT_WORKSPACE_GIT_REMOTE: ${THT_WORKSPACE_GIT_REMOTE:?set THT_WORKSPACE_GIT_REMOTE}
+      THT_WORKSPACE_GIT_BRANCH: ${THT_WORKSPACE_GIT_BRANCH:-main}
+      THT_WORKSPACE_INSTALLATION_ID: ${THT_WORKSPACE_INSTALLATION_ID:-local}
+      THT_WORKSPACE_SECRET_ROOTS: /run/secrets
+      THT_SECRETS_FILE: /run/secrets/thothii.secrets
+      THT_DB_NAME: ${THT_DB_NAME:-}
+      THT_DWH_REST_URL: ${THT_DWH_REST_URL:-}
+      THT_LLM_URL: ${THT_LLM_URL:-}
+      THT_INTERNAL_QDRANT_URL: http://qdrant:6333
+      THT_INTERNAL_EMBEDDING_URL: http://embedding:11434
+      THT_INTERNAL_EMBEDDING_MODEL: qwen3-embedding:0.6b
+      THT_INTERNAL_EMBEDDING_DIMENSIONS: "1024"
+      HOME: /tmp/thoth
+      AWS_ACCESS_KEY_ID: ""
+      AWS_SECRET_ACCESS_KEY: ""
+      AWS_SESSION_TOKEN: ""
+      AWS_PROFILE: ""
+      AWS_DEFAULT_PROFILE: ""
+      AWS_CONFIG_FILE: /dev/null
+      AWS_SHARED_CREDENTIALS_FILE: /dev/null
+    volumes:
+      - type: volume
+        source: workspace-registry
+        target: /data/workspace-registry
+        read_only: true
+      - type: volume
+        source: sessions
+        target: /data/sessions
+    secrets:
+      - source: thothii_secrets
+        target: thothii.secrets
+    user: "10001:10001"
+    read_only: true
+    tmpfs:
+      - /tmp:rw,noexec,nosuid,nodev,size=64m,mode=1777
+      - /var/tmp:rw,noexec,nosuid,nodev,size=32m,mode=1777
+    cap_drop:
+      - ALL
+    security_opt:
+      - no-new-privileges:true
+    restart: "no"
+    networks:
+      - thothii
+
   frontend:
     build:
       context: .