ci: carry the 95m ingress body cap in the N0 release template

Raise CLIENT_MAX_BODY_SIZE 32m -> 95m in the root compose (#309's
approved ca110b0b… becomes b0cd8248…, 2 bytes) and lock the release
template over those bytes: 92641ed5…. #309's approved pre-cap bytes no
longer satisfy the template. Pre-N0 template and captured rollback
artifacts are unchanged.

Refs TC-959, TC-1012

Author: samgbafa

.github/workflows/docker.yml

@@ -663,9 +663,9 @@ jobs:
               raise SystemExit('::error::Deployment destination is not the fixed reviewed path')
           native = 'ghcr.io/tinycloudlabs/tinycloud-node'
           reviewed = native + '@sha256:4bdae4fc232d886bb56bfbce4ec62ed4b8fb4e1369a01f6afb73d06dd68c188f'
-          # TC-959: #309's reviewed N0 compose (raw ca110b0b… with the 1.20.6
-          # pin) with its single node digest normalized to 64 zeros.
-          n0_template_hash = '92be17ff125e5d4cada9b81d7a8e655442fa66a454e19f76e3f8880a93123d3d'
+          # TC-959: main's N0 compose (#349 c33c2302…) with the 95m ingress body
+          # cap (raw d95bfb70…), its single node digest normalized to 64 zeros.
+          n0_template_hash = '51f8e9e93edc0e16025d27ee42abe003ed5d1cf26ba8f437d5120894aca64bdb'
           node_pin = re.compile(rb'(?m)^    image: ghcr\.io/tinycloudlabs/tinycloud-node@sha256:([0-9a-f]{64})$')
           def n0_template(raw):
               pins = list(node_pin.finditer(raw))

docker-compose.dstack-postgres.yaml

@@ -111,7 +111,7 @@ services:
       - CERTBOT_EMAIL=${CERTBOT_EMAIL}
       - SET_CAA=true
       - DNS_PROVIDER=cloudflare
-      - CLIENT_MAX_BODY_SIZE=32m
+      - CLIENT_MAX_BODY_SIZE=95m
     volumes:
       - /var/run/dstack.sock:/var/run/dstack.sock
       - cert-data:/etc/letsencrypt

docs/releasing.md

@@ -67,8 +67,10 @@ inside `deploy-phala`). Other refs fail `Deploy refused (main-only)`.
 
 **Release order:** approved #310 must never merge alone. Land #310 and its
 stacked recovery changes atomically as one lineage, preserving emergency
-re-promotion and security rollback first. #309's sidecar compose may then
-ship in the same window as a main release, promoted by one dispatch (see
+re-promotion and security rollback first. #309's sidecar compose then ships
+on the unchanged 1.20.6 image under that lineage's exact raw-hash lock. The
+later main release lands this template lock and the 95m ingress body cap,
+and is promoted by one dispatch (see
 [Main release with N0 log shipping](#main-release-with-n0-log-shipping-one-dispatch)).
 These docs grant no merge or dispatch authority. Merging either workflow
 change is a push, not a deployment dispatch.
@@ -270,9 +272,10 @@ its branch policy before any workflow that names it runs.
 
 ### Main release with N0 log shipping (one dispatch)
 
-Ships a main release and #309's log sidecar together. Before dispatching,
-`main` must contain the combined workflow lineage and #309, plus the merged
-`chore(release): 1.21.0` commit tagged `v1.21.0`. Take the digest and
+Ships a main release on #309's log sidecar compose. Before dispatching,
+`main` must contain the combined workflow lineage, #309, the template-lock
+change that also raises the ingress `CLIENT_MAX_BODY_SIZE` to `95m`, and the
+merged `chore(release): 1.21.0` commit tagged `v1.21.0`. Take the digest and
 labels of the tag build's `1.21.0-dstack` image as in step 1 above:
 
 ```sh
@@ -290,9 +293,12 @@ Before any CVM mutation the workflow requires:
 
 - the main compose, with its one node digest replaced by 64 zeros, to hash
   to the reviewed N0 template
-  **`92be17ff125e5d4cada9b81d7a8e655442fa66a454e19f76e3f8880a93123d3d`**
-  (#309's raw `ca110b0bae6d5a06a1002fb80df3f71cffec11659c9f9dbfa5d72624735546f6`
-  normalized). Ingress, socat, Vector and the log profile stay byte-exact;
+  **`51f8e9e93edc0e16025d27ee42abe003ed5d1cf26ba8f437d5120894aca64bdb`**
+  (raw `d95bfb707871c1d626c4a8f2b8d32d354103edbb5077847c6a21fe5f7f6cfa50` normalized: the #349 compose
+  `c33c23021589163b62a71ef245b7194717711922027629f155bdd5cff806b8c7`, which
+  keeps `TINYCLOUD_EPOCH_HEAD_BACKFILL__ENABLED: "false"` and #346's Vector
+  config, with only `CLIENT_MAX_BODY_SIZE=32m` → `95m`). Ingress, socat,
+  Vector and the log profile stay byte-exact;
 - the deployed compose to differ from that template only by
   `deploy_image_digest`;
 - OCI labels `1.21.0-dstack` / `<release-commit-sha>`, the `v1.21.0` tag on
@@ -345,11 +351,10 @@ gh workflow run docker.yml -R TinyCloudLabs/tinycloud-node --ref main \
 ```
 
 The served/OCI identity remains **1.20.6-dstack / e18578ff9162986ddd813259c60f73866e3e60d1**.
-With #309 on main this redeploys exactly #309's reviewed raw compose
-`ca110b0bae6d5a06a1002fb80df3f71cffec11659c9f9dbfa5d72624735546f6`
-(from reviewed head `44eeb20a1461ef66b5af492e3be4c42be2728b67`,
-[approval](https://github.com/TinyCloudLabs/tinycloud-node/pull/309#issuecomment-6224650050)),
-whatever digest main's template currently pins. It is not a rollback of a
+With the template lock on main this redeploys exactly main's raw compose
+`d95bfb707871c1d626c4a8f2b8d32d354103edbb5077847c6a21fe5f7f6cfa50`
+(the #349 compose `c33c2302…` plus the 95m ingress body cap), whatever digest
+main's template currently pins. It is not a rollback of a
 later release across a schema migration. Current pre-N0 tag/pinned
 equivalents are separately hash-checked; arbitrary same-image config
 substitutions fail before mutation.

docs/runbooks/tc-959-n0-log-shipping.md

@@ -147,6 +147,7 @@ Keep these identities distinct:
 | Before: verifier `docker_compose_file` / hash | Raw preserved pre-N0 compose: `df239749ca0a9c09893a855ae2a8abb94090b8556515ad002105c58ac91f4c91` |
 | Before: application `compose_hash` | `bfe9028a58b23238188aa7d70b82282a7cd6414cd83dcc47a3b295c6f64fe2f8`; a distinct reported identity, not the raw-file hash |
 | After: current profile-enabled raw compose | `c33c23021589163b62a71ef245b7194717711922027629f155bdd5cff806b8c7`; bind this artifact to the final reviewed PR head before any promotion |
+| After the main release: template-locked raw compose | `d95bfb707871c1d626c4a8f2b8d32d354103edbb5077847c6a21fe5f7f6cfa50` (main's compose with only `CLIENT_MAX_BODY_SIZE=32m` → `95m`); node digest normalized, template `51f8e9e93edc0e16025d27ee42abe003ed5d1cf26ba8f437d5120894aca64bdb`. See [`docs/releasing.md`](../releasing.md#main-release-with-n0-log-shipping-one-dispatch) |
 
 The raw after hash identifies the profile-enabled compose, not deployment approval. Record its final reviewed PR head and required CI evidence in the officer handoff. Do not infer a raw-file hash from the distinct application-reported compose hash.
 

scripts/ci/fixtures/tc959-n0-compose.yaml

@@ -111,7 +111,7 @@ services:
       - CERTBOT_EMAIL=${CERTBOT_EMAIL}
       - SET_CAA=true
       - DNS_PROVIDER=cloudflare
-      - CLIENT_MAX_BODY_SIZE=32m
+      - CLIENT_MAX_BODY_SIZE=95m
     volumes:
       - /var/run/dstack.sock:/var/run/dstack.sock
       - cert-data:/etc/letsencrypt

scripts/ci/test-deploy-recovery.py

@@ -330,6 +330,7 @@ def test_n0_template_drift_refuses_release_digest(self):
         node_line = b"    image: ghcr.io/tinycloudlabs/tinycloud-node@" + DIGEST.encode() + b"\n"
         for name, compose in (("profile", N0.replace(b":-errors_slow}", b":-all_requests}")),
                               ("ingress", N0.replace(b"63c1c44e2ded5b73a5f174807b91ca677826974df0f9ab3045f6ec87865a5744", b"e" * 64)),
+                              ("approved pre-cap bytes", N0.replace(b"CLIENT_MAX_BODY_SIZE=95m", b"CLIENT_MAX_BODY_SIZE=32m")),
                               ("crlf", N0.replace(b"\n", b"\r\n")),
                               ("duplicate node", N0.replace(node_line, node_line * 2)),
                               ("quoted node", N0.replace(b"@" + DIGEST.encode(), b"@" + DIGEST.encode() + b"'").replace(