feat(deploy): add opt-in agent canary profile

deploy/docker-compose.prod.yml

@@ -84,6 +84,19 @@ services:
     volumes:
       - assistant_core_secrets:/run/secrets:ro
 
+  agent-canary:
+    profiles: ["agent-canary"]
+    build: { context: .., dockerfile: deploy/images/runtime.Dockerfile, args: { TARGET: agent-canary, SOURCE_REVISION: "${ASSISTANT_SOURCE_REVISION:-unknown}" } }
+    restart: "no"
+    command: ["-enable-canary", "-postgres"]
+    environment:
+      POSTGRES_HOST: postgres
+      POSTGRES_PORT: "5432"
+      POSTGRES_DATABASE: ${POSTGRES_DB:-assistant}
+      WORK_POSTGRES_USER: work_role
+      WORK_POSTGRES_PASSWORD: ${WORK_DB_PASSWORD}
+    depends_on: { postgres: { condition: service_healthy } }
+
   continuity-runtime:
     build: { context: .., dockerfile: deploy/images/runtime.Dockerfile, args: { TARGET: continuity-runtime, SOURCE_REVISION: "${ASSISTANT_SOURCE_REVISION:-unknown}" } }
     restart: unless-stopped

dev/ACTIVE_TASK.json

@@ -1,5 +1,5 @@
 {
-  "task_file": "dev/tasks/DEV-000127-apply-agent-execution-migration.json",
-  "task_id": "DEV-000127",
+  "task_file": "dev/tasks/DEV-000128-agent-canary-compose-profile.json",
+  "task_id": "DEV-000128",
   "task_revision": 1
 }

dev/tasks/DEV-000128-agent-canary-compose-profile.json

@@ -0,0 +1,23 @@
+{
+  "task_id": "DEV-000128",
+  "task_revision": 1,
+  "architecture_revision": "ADR-0018",
+  "base_repo_revision": "790fd7e",
+  "risk_tier": "E",
+  "intent": "Add an explicitly profiled production compose service for the manual agent canary container.",
+  "requirement_ids": ["WP-301", "Canary container profile", "Disabled-by-default runtime"],
+  "allowed_change_scope": {"modules": ["work-agent-execution", "production-compose"], "paths": ["deploy/docker-compose.prod.yml", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000128-agent-canary-compose-profile.json"]},
+  "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "runtime/**", "adapters/**", ".gitea/**"]},
+  "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 1, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
+  "contracts": {"consume": ["DEV-000126 agent-canary postgres mode", "DEV-000127 migration 029"], "may_change": ["Production compose canary profile"]},
+  "semantic_owner": "work-agent-execution",
+  "canonical_state": ["No new state; uses Work schema"],
+  "state_transitions": ["profile absent -> explicit profile service available; default stack unchanged"],
+  "side_effects_and_privileges": ["Credential environment is injected by deployment system; service is disabled unless profile is explicitly selected"],
+  "persistence_and_migrations": ["Requires migration 029 already present; no migration in this task"],
+  "failure_retry_restart": ["restart=no; one bounded canary invocation"],
+  "assumptions": ["Deployment of this profile is a separate approved canary action", "No normal service depends on agent-canary"],
+  "acceptance_scenarios": ["Compose validates", "Default config does not start agent-canary", "Profile builds target cmd/agent-canary", "No secret literal is added"],
+  "required_tests": ["go test ./...", "go vet ./...", "docker compose -f deploy/docker-compose.prod.yml config --quiet", "preflight", "check-diff", "check-architecture", "independent", "git diff --check"],
+  "terminal_gap_states": ["BLOCKED_BY_DEPLOYMENT_DECISION", "BLOCKED_BY_CONFLICT"]
+}