fix(hwlab): pull latest d601 tools image in pipeline (#824)

Co-authored-by: Codex <codex@noreply.local>

scripts/src/hwlab-node-control-plane.ts

@@ -127,10 +127,11 @@ interface ControlPlaneTargetSpec {
     pipelineName: string;
     serviceAccountName: string;
     pipelineRunPrefix: string;
-    toolsImage: {
-      output: string;
-      sourceKind: "dockerfile" | "docker-compose";
-      context: string;
+      toolsImage: {
+        output: string;
+        imagePullPolicy: "Always" | "IfNotPresent" | "Never";
+        sourceKind: "dockerfile" | "docker-compose";
+        context: string;
       dockerfile?: string;
       dockerfileInline?: DockerfileInlineSpec;
       composeFile?: string;
@@ -671,6 +672,8 @@ function imagePolicySpec(raw: Record<string, unknown>): ControlPlaneImagePolicy
 function toolsImageSpec(raw: Record<string, unknown>, path: string): ControlPlaneTargetSpec["tekton"]["toolsImage"] {
   const sourceKind = stringField(raw, "sourceKind", path);
   if (sourceKind !== "dockerfile" && sourceKind !== "docker-compose") throw new Error(`${path}.sourceKind must be dockerfile or docker-compose`);
+  const imagePullPolicy = optionalStringField(raw, "imagePullPolicy", path) ?? "IfNotPresent";
+  if (imagePullPolicy !== "Always" && imagePullPolicy !== "IfNotPresent" && imagePullPolicy !== "Never") throw new Error(`${path}.imagePullPolicy must be Always, IfNotPresent, or Never`);
   const publicBaseImages = stringArrayField(raw, "publicBaseImages", path);
   if (publicBaseImages.length === 0) throw new Error(`${path}.publicBaseImages must list at least one public base image`);
   for (const image of publicBaseImages) validatePublicBaseImage(image, `${path}.publicBaseImages`);
@@ -687,6 +690,7 @@ function toolsImageSpec(raw: Record<string, unknown>, path: string): ControlPlan
   }
   return {
     output: stringField(raw, "output", path),
+    imagePullPolicy,
     sourceKind,
     context: stringField(raw, "context", path),
     dockerfile,