test(oracle): port upstream reference tests as an independent behavior oracle

The 9 bugs from the recent hunt slipped past our own tests because we
reimplemented the code AND wrote the tests from the same reading of the spec —
so the test encoded the same misunderstanding as the code. The fix is to port
the UPSTREAM test suite verbatim: its inputs and expected values come from the
reference authors, so it catches divergences our hand-written tests cannot.

Ported as TestOracle_* (provenance noted in each file):
  - imageMetadata.test.ts merge rules: remoteEnv last-wins, mount de-dup by
    target (the exact case that would have caught this cycle's mount bug), gpu
    requirement merge.
  - utils.test.ts: isBuildxCacheToInline (whitespace/casing/embedded specs).
  - workspaceConfiguration.test.ts: the basic /workspaces/<basename> mount (the
    git-worktree cases are a documented divergence and intentionally not ported).

Entries are built from the exact JSON the TS tests use to avoid translation drift.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: aledbf

internal/config/reference_oracle_test.go

@@ -0,0 +1,31 @@
+package config
+
+// Oracle test ported from the upstream devcontainers CLI:
+//   reference/src/test/workspaceConfiguration.test.ts
+//   (describe 'getWorkspaceConfiguration' > 'basic workspace mounting').
+//
+// Only the basic /workspaces/<basename> mount is ported: the rest of that suite
+// exercises git-worktree common-dir mounting, which is a documented divergence
+// (see docs/DIVERGENCES.md) — we deliberately do not implement it, so porting
+// those would import behavior we do not have. The platform matrix is reduced to
+// linux, the CI runtime (consistency is empty on linux; computeWorkspaceConfig
+// reads runtime.GOOS directly and cannot be faked hermetically).
+
+import (
+	"runtime"
+	"testing"
+)
+
+func TestOracle_WorkspaceMountBasename(t *testing.T) {
+	if runtime.GOOS != "linux" {
+		t.Skip("oracle pins the linux consistency behavior")
+	}
+	// mountWorkspaceGitRoot=false, no .git → the workspace folder mounts directly.
+	wc := computeWorkspaceConfig(&Workspace{RootFolderPath: "/home/user/project"}, &DevContainer{}, false)
+	if wc.WorkspaceFolder != "/workspaces/project" {
+		t.Errorf("workspaceFolder = %q, want /workspaces/project", wc.WorkspaceFolder)
+	}
+	if wc.WorkspaceMount != "type=bind,source=/home/user/project,target=/workspaces/project" {
+		t.Errorf("workspaceMount = %q", wc.WorkspaceMount)
+	}
+}

internal/docker/reference_oracle_test.go

@@ -0,0 +1,29 @@
+package docker
+
+// Oracle test ported VERBATIM from the upstream devcontainers CLI:
+//   reference/src/test/utils.test.ts  (describe 'isBuildxCacheToInline').
+// The cases (whitespace, casing, embedded in a larger spec) come from the
+// reference author, so they pin our regex to the spec behavior.
+
+import "testing"
+
+func TestOracle_IsBuildxCacheToInline(t *testing.T) {
+	cases := []struct {
+		in   string
+		want bool
+	}{
+		{"", false}, // undefined/empty
+		{"type=inline", true},
+		{"type = inline", true},
+		{"type=INLINE", true},
+		{"mode=max,type=inline,compression=zstd", true},
+		{"type=registry", false},
+		{"type=local", false},
+		{"inline", false},
+	}
+	for _, c := range cases {
+		if got := isBuildxCacheToInline(c.in); got != c.want {
+			t.Errorf("isBuildxCacheToInline(%q) = %v, want %v", c.in, got, c.want)
+		}
+	}
+}