feat: complete catalog-driven preprocessing

scripts/test-default-compose.sh

@@ -11,7 +11,8 @@ grep -q "pg_read_file('/run/secrets/catalog_runtime_password')" docker/catalog-d
 grep -q "CREATE ROLE thothii_catalog_runtime" docker/catalog-db-init.sql
 
 rendered=$(mktemp)
-trap 'rm -f "$rendered"' EXIT HUP INT TERM
+installation_rendered=$(mktemp)
+trap 'rm -f "$rendered" "$installation_rendered"' EXIT HUP INT TERM
 
 docker compose --env-file deploy/env/local.env.example \
   -f compose.yaml -f deploy/compose.local.yaml config --format json >"$rendered"
@@ -131,4 +132,21 @@ if (JSON.stringify(embedding).includes('"devices"')) {
 }
 NODE
 
+THT_WORKSPACE_INSTALLATION_ID=psd-local docker compose \
+  --env-file deploy/env/local.env.example \
+  -f compose.yaml -f deploy/compose.local.yaml \
+  --profile workspace-maintenance config --format json >"$installation_rendered"
+
+node - "$installation_rendered" <<'NODE'
+const fs = require("fs");
+
+const config = JSON.parse(fs.readFileSync(process.argv[2], "utf8"));
+for (const serviceName of ["core", "workspace-maintenance"]) {
+  const actual = config.services[serviceName]?.environment?.THT_WORKSPACE_INSTALLATION_ID;
+  if (actual !== "psd-local") {
+    throw new Error(`${serviceName} must preserve the configured installation ID, got: ${actual}`);
+  }
+}
+NODE
+
 echo "default Compose contract passed."