[samgbafa]

What changes

• deploy/personal-node/compose.yaml and node.sh: the ordinary profile pins the published 1.22.0 image index sha256:2f3c65d85aa94610456bf09cd54713bab5260097bb3d56858025bc6eadb5a4a0. The digest is the manifest list pushed by the docker.yml run for the v1.22.0 tag (run 40031807112, job build, "Digest" group; the same value appears in the pushing manifest for ghcr.io/tinycloudlabs/tinycloud-node:1.22.0@sha256:... lines). No image was pulled to obtain it.
• 1.20.6 (sha256:41667d3d...) is in node.sh only as the previous image of the upgrade rehearsal. The 1.20.5 image is removed.
• deploy/personal-node/ci.sh: a fresh 1.22.0 install; then 1.20.6 -> 1.22.0 with signed KV/SQL checks before and after, backup and fresh restores, and rollback by restoring the pre-upgrade snapshot onto 1.20.6. The missing-key check runs on the fresh 1.22.0 install and on the 1.20.6 instance.
• node.sh check-bare-image-missing-key (called from ci.sh on the fresh 1.22.0 instance): starts the 1.22.0 image as published, with no mounted config, key or environment, and requires exit 1 plus the node's exact Missing secret line. It shares its matcher with check-missing-key.
• node.sh check-version also fails if /version lists encryption-named-keys-v1 or sql-delegated-caveats-v1, which are disabled by default in 1.22.0.
• deploy/personal-node/README.md: pins and CI description; the seven database migrations the upgrade applies (1.21.0: four, 1.21.3, 1.21.8, 1.21.9; none in 1.22.0); rollback is a restore of the pre-upgrade backup; named keys and delegated SQL caveats are disabled by default; images are pinned by digest.

Scope

• The dstack Compose profile (1.20.6-dstack) is unchanged.
• The mounted keyless tinycloud.toml is unchanged.
• Enabling named keys or delegated SQL caveats is not exercised.
• No CHANGELOG entry: TC-1282: Test a personal-node installation guide #308, which added these files, did not add one.

Verification

CI jobs of the "Personal node guide" workflow: published-images (runs ci.sh), dstack-profile, dstack-config-source. bash -n passes on node.sh and ci.sh, and the bare-image matcher was checked locally against a stand-in docker command (no Docker daemon).

Details: TC-1282

[samgbafa]

APPROVE: see TC-1282 (reviewed exact head 915e6a8)

[samgbafa]

APPROVE: see TC-1282 (reviewed exact head e865c28; main-merge-only change from the approved 915e6a8, non-CHANGELOG patch-id 0472e3127beb unchanged)

[samgbafa]

Merged main into the branch: 915e6a8 → e865c28. PR-diff patch-id 0472e3127beb is identical before and after, and the delta touches only files main changed, so the review at 915e6a8 stands.