test(e2e): pin Compose shutdown sidecars to Devsy GHCR

[skevetter]

The two Compose shutdown fixtures currently pull alpine:latest from Docker Hub solely to keep a sidecar running with sleep infinity. Pin those two sidecars to the existing public Devsy Alpine base at sha256:fbd195076b0c5d37580debed78de5e4dd238436cd5aa348339a4d48463ff71ae.

This is role-specific reuse of a richer Alpine 3.23 Dev Container image. Anonymous source/candidate pulls and Compose checks on Linux arm64 and amd64 verified root runtime user, working directory /, PID 1 sleep, temporary-file access, and unchanged stop behavior. The app images, commands, mounts, shutdown configuration, test bodies and timeouts are unchanged. No image publication is needed for this slice.

Closes #1451.

Parent migration tracker: #1449 remains open for verified bare runtime mirrors, service-image mirrors and the later inventory guard.

Validation:

• Both existing shutdown regression cases and the reused missing-app secret recovery case pass (3/3) against the reviewed change.
• Framework and Compose unit tests pass; applicable pre-commit, commit-message and pre-push hooks pass. task cli:lint:ci reports zero issues.
• Local CodeRabbit covers both changed files with zero findings; independent source review finds no defect. CodeScene does not support YAML, so no analyzer score is claimed.
• Full unchanged up-docker-compose label: 49 passed, 6 failed in 798.527 seconds. All three changed-fixture cases pass in this full run too; a read-only observer verified both pinned shutdown sidecars running before stop. Failures: two UID-mapping checks reproduced with unchanged main fixtures; three macOS Feature-copy lchown: operation not permitted errors reproduced separately with unchanged fixtures; and the unchanged multistage build after Debian HTTP package-download failures exhausted the configured retries. All six failure identities reproduce against unchanged main 56485803a98ccbf0505b1b42b8ecc12629ccfaf9. The package case also fails on its single bounded rerun with existing retries and sources unchanged. The full local gate remains unresolved and is not waived.
• Existing personal GPG commit 81653971450e7021b1fc3c1469dcc950b70e5fc6 verifies locally and on GitHub (verified: true, reason: valid).

The full local label is failing. This remains Draft, with hosted final-head review/CI and merge pending.

[netlify]

✅ Deploy Preview for devsydev canceled.

Name	Link
🔨 Latest commit	8165397
🔍 Latest deploy log	https://app.netlify.com/projects/devsydev/deploys/6ac941b02dbba300085711e7

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[netlify]

✅ Deploy Preview for images-devsy-sh canceled.

Name	Link
🔨 Latest commit	8165397
🔍 Latest deploy log	https://app.netlify.com/projects/images-devsy-sh/deploys/6ac941b167d5080008d2ee61