backend: require confirmation for signed channel updates [CI]

compose.yaml

@@ -1,6 +1,6 @@
 services:
   backend:
-    image: registry.oeo.one/moshiro/moshiro-backend:${MOSHIRO_VERSION:-0.1.1}
+    image: registry.oeo.one/${MOSHIRO_IMAGE_NAMESPACE:-moshiro}/moshiro-backend:${MOSHIRO_VERSION:-0.1.1}
     container_name: moshiro-backend
     restart: unless-stopped
     init: true
@@ -9,10 +9,13 @@ services:
     environment:
       ASPNETCORE_HTTP_PORTS: "8080"
       MoShiro__DataDirectory: /data
+      MoShiro__UpdateChannel: ${MOSHIRO_UPDATE_CHANNEL:-auto}
+      MoShiro__ImageNamespace: ${MOSHIRO_IMAGE_NAMESPACE:-moshiro}
       MoShiro__InitialAdminUser: ${MOSHIRO_ADMIN_USER:-admin}
       MoShiro__InitialAdminPassword: "${MOSHIRO_ADMIN_PASSWORD:?Set MOSHIRO_ADMIN_PASSWORD in the environment}"
     volumes:
       - moshiro-backend-data:/data
+      - moshiro-backend-status:/data/update-status:ro
     read_only: true
     tmpfs:
       - /tmp:rw,noexec,nosuid,size=64m,mode=1777
@@ -25,3 +28,5 @@ services:
 volumes:
   moshiro-backend-data:
     name: moshiro-backend-data
+  moshiro-backend-status:
+    name: moshiro-backend-status