Pack each project fragment's share of the images lock, and union the shares in composition #230

Parent

#195

What to build

Each project's Intent Fragment carries its own share of the images lock, as chapter 40 requires (spec/v1/40-composition.md#fragments): every image alias its project file names, resolved to the digest its release pushed, with the UID and GID the image runs as. Composition unions the shares into the one images lock that resolution reads.

Today deploy-kit publish packs no images lock into a project's fragment, and composition reads the estate-wide lock the Platform document's fragment carries. The worked publish workflow says so where its lock step used to be.

Acceptance criteria

• deploy-kit publish packs a project's share of the images lock: every alias its project file names, and nothing else. An alias the lock it is handed does not hold is refused.
• composeEstate unions every fragment's share. Two fragments resolving one alias to different digests is a refusal that isolates the changed fragment.
• The Platform document's fragment no longer has to carry the project images, and the worked publish workflow packs the share.
• Tested at the compose seam and through the CLI, with coverage and Stryker holding at 100.

Blocked by

• Compose the estate: a compose use-case and CLI, pin annotations and fragment versions #197