fix(deploy): verify Docker clone updates against the served release

src/test/ci-deploy-harness.sh

@@ -42,3 +42,6 @@ docker() {
   esac
 }
 export -f git flock pnpm curl sleep docker
+
+node() { echo "node $*" >> "$TEST_DIR/calls"; [ "$SCENARIO" != release-failure ]; }
+export -f node

src/test/docker-update-harness.sh

@@ -0,0 +1,32 @@
+# Test doubles; never calls real Docker, Git remotes or databases.
+git() {
+  echo "git $*" >> "$TEST_DIR/calls"
+  case "$1" in
+    status) if [ "$SCENARIO" = dirty ]; then echo ' M local.ts'; fi ;;
+    hash-object) echo unchanged ;;
+    rev-parse) if [ "${2:-}" = HEAD ]; then echo "$TEST_SHA"; else echo origin/main; fi ;;
+    pull) [ "$SCENARIO" != pull-failure ] ;;
+  esac
+}
+flock() { :; }
+sleep() { :; }
+docker() {
+ echo "docker $*" >> "$TEST_DIR/calls"
+ case "$1 ${2:-}" in
+  'inspect --format')
+   if [ "${@: -1}" = epicnext-cms-app ]; then [ "$SCENARIO" = ci-active ] && echo true; return 0; fi
+   if [ "$SCENARIO" = wrong-image ]; then echo sha256:old; else echo sha256:new; fi ;;
+  'image inspect')
+   if [[ "$*" = *org.opencontainers* ]]; then echo "$TEST_SHA"; else echo sha256:new; fi ;;
+  'compose config') return 0 ;;
+  'compose build') [ "$SCENARIO" != build-failure ] ;;
+  'compose up') [ "$SCENARIO" != recreate-failure ] ;;
+  'compose ps') echo container123 ;;
+  'run --rm') [ "$SCENARIO" != migration-failure ] ;;
+  'exec container123')
+   if [ "$SCENARIO" = wrong-release ]; then return 1; fi
+   if [ "$SCENARIO" = wrong-public ] && [[ "$*" = *example.test* ]]; then return 1; fi ;;
+  *) return 0 ;;
+ esac
+}
+export -f git flock sleep docker