test: lock backend-core artifact readiness contract

scripts/src/deploy.ts

@@ -982,7 +982,7 @@ function artifactConsumerPlanValidation(service: UniDeskMicroserviceConfig, envi
   const base = [
     "reads origin/master:deploy.json for commit intent",
     "requires a commit-pinned artifact in 127.0.0.1:5000",
-    "verifies image labels for service id, source commit, and Dockerfile",
+    "verifies image labels for service id, source repo, source commit, and Dockerfile",
     "does not build source on the runtime target",
   ];
   if (kind === "d601-k3s-managed") {
@@ -2997,6 +2997,7 @@ function environmentDryRunPlan(
             tag: service.commitId,
             imageRef: `127.0.0.1:5000/unidesk/${service.id}:${service.commitId}`,
             digest: null,
+            digestHeader: "Docker-Content-Digest",
             digestSource: "planned registry manifest HEAD; live apply records Docker-Content-Digest before mutation",
           },
           source: unsupported ? null : {
@@ -3011,6 +3012,12 @@ function environmentDryRunPlan(
             willRunDockerComposeBuild: false,
             producerBoundary: service.id === "backend-core" ? "ci publish-backend-core" : "ci publish-user-service",
           },
+          requiredLabels: unsupported ? null : {
+            "unidesk.ai/service-id": service.id,
+            "unidesk.ai/source-repo": service.repo,
+            "unidesk.ai/source-commit": service.commitId,
+            "unidesk.ai/dockerfile": serviceConfig.repository.dockerfile,
+          },
           noRuntimeSourceBuild: unsupported || planKind !== "d601-dev-target-side-build",
           dryRunOnly: unsupported || (environment === "prod" && prodArtifactLiveApplyBlockedServiceIds.has(service.id)) || dryRunBlockedReason !== null,
           blockedReason: unsupportedReason ?? dryRunBlockedReason ?? (environment === "prod" ? prodArtifactLiveApplyBlockedServiceIds.get(service.id) ?? null : null),