fix: bind release image metadata and validate consumer mode

.github/workflows/docker-runner-check.yml

@@ -92,6 +92,11 @@ jobs:
           TRIGGERING_ACTOR: ${{ github.triggering_actor }}
           ALLOWED_IDS: ${{ vars.AWS_CI_TRUSTED_USER_IDS }}
           TARGET_BRANCH: ${{ inputs.target_branch || github.ref_name }}
+          RELEASE_RUN_ID: ${{ inputs.release_run_id }}
+          PUBLISH_EVAL_IMAGE: ${{ inputs.publish_eval_image }}
+          VERIFY_SOURCE: ${{ inputs.verify_source }}
+          VERIFY_PUBLIC_INSTALL: ${{ inputs.verify_public_install }}
+          BUILD_EVAL_VIEWER: ${{ inputs.build_eval_viewer }}
         run: |
           set -euo pipefail
           test "$REPOSITORY" = paperclipai/paperclip
@@ -101,6 +106,13 @@ jobs:
           for id in "$ACTOR_ID" "$triggering_id"; do
             jq -e --argjson id "$id" 'index($id) != null' <<< "$ALLOWED_IDS" >/dev/null
           done
+          if [ -n "$RELEASE_RUN_ID" ]; then
+            [[ "$RELEASE_RUN_ID" =~ ^[1-9][0-9]*$ ]]
+            test "$PUBLISH_EVAL_IMAGE" = true
+            test "$VERIFY_SOURCE" != true
+            test "$VERIFY_PUBLIC_INSTALL" != true
+            test "$BUILD_EVAL_VIEWER" != true
+          fi
           if [[ "$TARGET_BRANCH" =~ ^[a-f0-9]{40}$ ]]; then
             target_sha="$(gh api "repos/$REPOSITORY/commits/$TARGET_BRANCH" --jq .sha)"
           else
@@ -203,6 +215,7 @@ jobs:
           image="ghcr.io/paperclipai/paperclip-daytona-runner:qualification-${SOURCE_SHA}-${GITHUB_RUN_ID}"
           docker buildx build --platform linux/amd64 \
             --build-arg "BASE_IMAGE=$RELEASE_BASE_IMAGE" \
+            --build-arg "SOURCE_REVISION=$SOURCE_SHA" \
             --tag "$image" --metadata-file remote-verification/image.json --push \
             remote-verification/release-context
           digest="$(jq -r '."containerimage.digest"' remote-verification/image.json)"
@@ -211,6 +224,7 @@ jobs:
           docker run --rm --entrypoint cat "$immutable" /opt/paperclip-runner/provider-pack/provider-pack.json \
             > remote-verification/image-provider-pack.json
           cmp remote-verification/release-context/provider-pack.json remote-verification/image-provider-pack.json
+          test "$(docker run --rm --entrypoint id "$immutable" -un)" = daytona
           docker run --rm --entrypoint sha256sum "$immutable" /usr/local/bin/paperclip-runnerd \
             > remote-verification/image-daemon.sha256
           expected="$(jq -r .daemonSha256 remote-verification/release-image-inputs.json)"