docs: publish Tend Compose continuity evidence

Export the reviewed allowlisted snapshot from private source commit 07c1655921f21ee5e4fc4d85639d199e8867b17d. This records the Docker Compose activation, schema-compatible rollback, and stateful migration resource findings from Observatory Preview 19 dogfooding.

AI-Assisted: OpenAI Codex
Signed-off-by: Cole Speelman <crspeelman@gmail.com>

internal/packager/packager_test.go

@@ -0,0 +1,77 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+
+package packager
+
+import (
+	"archive/tar"
+	"compress/gzip"
+	"errors"
+	"io"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestVersionPattern(t *testing.T) {
+	for _, v := range []string{"v0.1.0-preview.1", "v12.3.4-preview.99"} {
+		if !versionPattern.MatchString(v) {
+			t.Errorf("rejected %q", v)
+		}
+	}
+	for _, v := range []string{"v0.1.0", "0.1.0-preview.1", "v0.1.0-preview.0", "v0.1.0-preview.01", "v0.1.0-preview.1+dirty"} {
+		if versionPattern.MatchString(v) {
+			t.Errorf("accepted %q", v)
+		}
+	}
+}
+func TestArchiveHasOnlyRegularBundleEntries(t *testing.T) {
+	dir := t.TempDir()
+	bundle := filepath.Join(dir, "bundle")
+	if err := os.Mkdir(bundle, 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(bundle, "app"), []byte("binary"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(bundle, "RELEASE.json"), []byte("{}\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	archive := filepath.Join(dir, "out.tar.gz")
+	if err := writeArchive(archive, bundle, 1); err != nil {
+		t.Fatal(err)
+	}
+	f, err := os.Open(archive)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer f.Close()
+	gz, err := gzip.NewReader(f)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer gz.Close()
+	tr := tar.NewReader(gz)
+	seen := 0
+	for {
+		h, err := tr.Next()
+		if errors.Is(err, io.EOF) {
+			break
+		}
+		if err != nil {
+			t.Fatal(err)
+		}
+		if h.Name == "bundle/" {
+			continue
+		}
+		if h.Typeflag != tar.TypeReg {
+			t.Fatalf("unexpected type %d", h.Typeflag)
+		}
+		if filepath.IsAbs(h.Name) || filepath.Clean(h.Name) != h.Name {
+			t.Fatalf("unsafe path %q", h.Name)
+		}
+		seen++
+	}
+	if seen != 2 {
+		t.Fatalf("saw %d files", seen)
+	}
+}