test(parity): enforce the containerd image store for the runtime lane

The runtime lane's update-UID and cache-export builds run
`docker build --platform` against locally-built images, which the legacy
graph-driver builder cannot resolve — only the containerd image store can.
Without it the TS oracle fails those builds while the Go CLI (which omits
--platform) succeeds, surfacing as confusing per-case TS-vs-Go divergences
(e.g. up.dotfiles-local-*).

Enforce the store up front: TestParityMatrix fails fast with an actionable
message when the runtime lane runs docker cases without it (covers a direct
`go test`, which skips the Taskfile preconditions), and parity:runtime /
coverage:parity-runtime gain a matching ~1s precondition. The contract lane
(PARITY_SKIP_DOCKER) and the default no-lane run are unaffected.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: aledbf

Taskfile.yml

@@ -133,6 +133,8 @@ tasks:
     preconditions:
       - sh: docker info >/dev/null 2>&1
         msg: Docker is required for runtime parity coverage
+      - sh: docker info 2>/dev/null | grep -q io.containerd.snapshotter
+        msg: The parity runtime lane requires the containerd image store (docker build --platform on local images); enable it with `task ci:prepare-runner`.
       - sh: bash scripts/docker-cache-export.sh
         msg: The Docker builder must support cache export (see scripts/ci-prepare-runner.sh)
     cmds:
@@ -221,6 +223,16 @@ tasks:
     preconditions:
       - sh: docker info >/dev/null 2>&1
         msg: Docker is required for runtime parity
+      # Fail fast (~1s) if the containerd image store is off: the runtime lane's
+      # update-UID / cache-export builds run `docker build --platform` against
+      # locally-built images, which only the containerd store can resolve. Without
+      # it the TS oracle fails those builds while Go succeeds → false divergences.
+      # The test itself re-checks this (so a direct `go test` is covered too).
+      - sh: docker info 2>/dev/null | grep -q io.containerd.snapshotter
+        msg: |
+          The parity runtime lane requires the containerd image store (docker build
+          --platform against locally-built images). Enable it with `task ci:prepare-runner`,
+          or add {"features":{"containerd-snapshotter":true}} to /etc/docker/daemon.json.
       # Fail fast (~1s) if the builder can't export build cache — otherwise the
       # runtime cases (build.cache-to-*, build.output-oci-*) fail ~4 min deep with
       # a cryptic buildkit error. The default `docker` driver lacks cache export.

internal/cli/parity_matrix_test.go

@@ -244,6 +244,20 @@ func TestParityMatrix(t *testing.T) {
 
 	dockerAvailable := isDockerAvailable()
 
+	// The runtime lane's update-UID and cache-export builds run
+	// `docker build --platform` against locally-built images, which the legacy
+	// graph-driver builder cannot resolve — only the containerd image store can.
+	// Without it the TS oracle fails those builds while the Go CLI (which omits
+	// --platform) succeeds, producing false TS-vs-Go divergences. Enforce the
+	// store up front — including on a direct `go test` that skips the Taskfile
+	// precondition — so a misconfigured daemon fails loudly with a fix, not as a
+	// confusing per-case divergence.
+	runtimeLane := os.Getenv("PARITY_LANE") != "" && os.Getenv("PARITY_SKIP_DOCKER") != "true"
+	if runtimeLane && dockerAvailable && !hasContainerdImageStore() {
+		t.Fatal("parity runtime lane requires the containerd image store (docker build --platform against local images). " +
+			"Enable it with `task ci:prepare-runner`, or add {\"features\":{\"containerd-snapshotter\":true}} to /etc/docker/daemon.json and restart Docker.")
+	}
+
 	// Sharding: split the selected cases round-robin across parallel CI jobs, so
 	// N runners (with independent docker daemons) share the wall-clock. Inert when
 	// PARITY_SHARD_TOTAL is unset or <= 1. Cases in other shards stay not-selected,
@@ -1128,6 +1142,17 @@ func isDockerAvailable() bool {
 	return cmd.Run() == nil
 }
 
+// hasContainerdImageStore reports whether the Docker daemon has the containerd
+// image store enabled (daemon.json {"features":{"containerd-snapshotter":true}}),
+// which surfaces as an io.containerd.snapshotter driver in `docker info`.
+func hasContainerdImageStore() bool {
+	out, err := exec.Command("docker", "info", "--format", "{{json .DriverStatus}}").Output()
+	if err != nil {
+		return false
+	}
+	return strings.Contains(string(out), "io.containerd.snapshotter")
+}
+
 func matchesFilter(tc parityCase) bool {
 	if os.Getenv("PARITY_NETWORK_ONLY") == "true" && !tc.NetworkRequired {
 		return false