Document the buildx version assumption behind the attestation workaround in pools.sh #167

What

Document the buildx version assumption behind the BUILDX_NO_DEFAULT_ATTESTATIONS=1 workaround in pools.sh (in the cmd_up path, where docker compose up is invoked).

Specifically:

• Add a comment near the BUILDX_NO_DEFAULT_ATTESTATIONS=1 prefix explaining that this env var is deprecated in newer buildx in favor of --provenance=false, and that the workaround depends on the pinned buildx version still honoring the env var.
• Note the failure mode if the assumption breaks: provenance attestations get re-enabled, image IDs change, the pool is recreated, and jobs are cancelled — silently, with no CI signal.
• Reference the related follow-up to migrate to --provenance=false (via build.args / buildx bake config) so the deprecation can be tracked.

Why

The current comment in pools.sh explains the workaround by making a specific claim about compose 5 dropping provenance: false from the bake definition. That claim is version-specific and will rot. More importantly, BUILDX_NO_DEFAULT_ATTESTATIONS is deprecated in newer buildx; if the project does not pin a buildx version, a future upgrade can silently stop honoring it, reintroducing the exact bug PR #164 fixed. The failure mode is invisible in CI (image IDs change → pool recreated → jobs cancelled), so a maintainer needs an explicit note tying the workaround to a buildx version assumption.

How

1. In pools.sh, locate the cmd_up function and the line invoking docker compose up with the BUILDX_NO_DEFAULT_ATTESTATIONS=1 prefix.
2. Expand the existing comment to:
   • State that BUILDX_NO_DEFAULT_ATTESTATIONS is deprecated in newer buildx and is only honored by the currently pinned buildx version.
   • State the consequence if the assumption is violated: attestations are re-enabled, image IDs change, the pool is recreated, jobs are cancelled — silently.
   • Point to the follow-up to migrate to --provenance=false via build.args / buildx bake config.
3. If the repo pins a buildx version anywhere (e.g. a Dockerfile, CI config, or tooling manifest), reference that pin in the comment so the assumption is traceable. If no pin exists, say so explicitly in the comment — that itself is the risk.
4. Do not change runtime behavior in this issue; this is documentation only.

Files Affected

• pools.sh

Constraints

• Must not change any runtime behavior — comment-only change.
• Must not remove or alter the BUILDX_NO_DEFAULT_ATTESTATIONS=1 prefix; the workaround stays until the migration follow-up lands.
• Out of scope: migrating to --provenance=false, adding a regression test for cmd_up idempotency, pinning a buildx version (separate follow-ups).
• Do not assert a specific buildx version number unless it is confirmed from the repo; describe the assumption instead.

LLM tier

Haiku — comment-only documentation change with no design judgment required.

Success looks like

• pools.sh contains a comment near the BUILDX_NO_DEFAULT_ATTESTATIONS=1 usage that names the deprecation, the buildx version assumption, and the silent failure mode.
• The comment references the migration follow-up (--provenance=false via build.args / buildx bake).
• No functional diff: git diff on pools.sh shows only comment lines added/changed.

Failure looks like

• The comment still only explains the compose-5 bake claim without mentioning the buildx deprecation or version assumption.
• The BUILDX_NO_DEFAULT_ATTESTATIONS=1 prefix is removed or replaced as part of this change.
• A specific buildx version is asserted without evidence from the repo.
• Any non-comment line in pools.sh is modified.

Follow-up from AI review of PR #164.