feat: profile-gated workspace-maintenance service and connector override generator (P2)

docker/core.Dockerfile

@@ -33,10 +33,16 @@ LABEL org.opencontainers.image.title="thothii-core" \
       io.thothii.pi.version="${PI_VERSION}"
 
 # Runtime tools
-RUN apt-get update && apt-get install -y --no-install-recommends \
-        curl ca-certificates ripgrep fd-find tini git openssh-client \
-    && rm -rf /var/lib/apt/lists/* \
-    && ln -s /usr/bin/fdfind /usr/local/bin/fd
+RUN set -eux; \
+    runtime_packages="curl ca-certificates ripgrep fd-find tini git openssh-client"; \
+    if ! command -v flock >/dev/null 2>&1; then \
+        runtime_packages="$runtime_packages util-linux"; \
+    fi; \
+    apt-get update; \
+    apt-get install -y --no-install-recommends $runtime_packages; \
+    rm -rf /var/lib/apt/lists/*; \
+    command -v flock >/dev/null 2>&1; \
+    ln -s /usr/bin/fdfind /usr/local/bin/fd
 
 # Node 22 + npm copiati dall'immagine ufficiale (stesso Debian bookworm → binario compatibile)
 COPY --from=node-runtime /usr/local/bin/node /usr/local/bin/node
@@ -91,10 +97,10 @@ ENV PATH="/opt/venv/bin:/usr/local/bin:$PATH" \
     HOME=/home/thoth
 
 COPY scripts/verify-line-endings.sh /usr/local/bin/verify-line-endings
-COPY docker/core-entrypoint.sh docker/session-migrate.sh docker/ensure-pi-trust.mjs docker/embedding-model-init.sh /app/docker/
+COPY docker/core-entrypoint.sh docker/workspace-maintenance-entrypoint.sh docker/session-migrate.sh docker/ensure-pi-trust.mjs docker/embedding-model-init.sh /app/docker/
 COPY docker/smoke/core-smoke.sh /app/docker/smoke/core-smoke.sh
 RUN /usr/local/bin/verify-line-endings /app/docker \
- && chmod +x /app/docker/core-entrypoint.sh /app/docker/session-migrate.sh /app/docker/embedding-model-init.sh /app/docker/smoke/core-smoke.sh
+ && chmod +x /app/docker/core-entrypoint.sh /app/docker/workspace-maintenance-entrypoint.sh /app/docker/session-migrate.sh /app/docker/embedding-model-init.sh /app/docker/smoke/core-smoke.sh
 
 WORKDIR /app/backend
 USER thoth