ci: gate controlled trial on container recovery and runtime health

[cb8010d6]

Why

Source tests and synthetic browser journeys did not establish that shipping Dockerfiles start or that PostgreSQL/object backups recover into fresh volumes. Deployment checks also accepted missing containers and health-starting states.

Changes

• Build current-head API production, migration builder and Web production images; start the complete isolated stack and verify login HTML, 11 static assets, API proxy and both HTTP journeys.
• Drain synthetic event work, back up PostgreSQL/MinIO, restore into fresh named volumes with exact running image IDs, and verify full-row identities/counts, actual tenant login and downloaded object bytes. Source remains unchanged; all owned containers/volumes are removed.
• Add the container job to blocking aggregate validate. Local Docker guards, random project names, loopback ports, generated masked credentials and allowlisted reports; no registry publication or production credentials.
• Shell/PowerShell deployment checks now require all core services and healthy runtime state; declared migration must exit 0. Bounded waits, preserved Compose/env arguments and explicit failures for missing/exited/unhealthy/starting-timeout cases.
• Document controlled-trial delivery and remaining operational boundaries.

Exact final-head evidence

Head 3b230aabfef41c116cc2a7db9f0f8c6dabc0b075, tree 8c502db9881c94b60f4474df355095343f036759 matches local integration exactly. CI 36291015931 passed every job and aggregate validate:

• 919 regular tests: 60 scripts +704 API +155 Web; zero script skips. All 11 new PowerShell deployment-check cases actually ran.
• 98 actual PostgreSQL regressions, 25 HTTP steps (13 stocked trade +12 manufacturing), 9 actual Chromium cases (browser auth/API synthetic).
• Actual shipping API/Web/migration Docker targets built and ran. Containerized HTTP journeys passed again. Fresh-volume recovery verified all 71 public tables/163 rows, retained engineering upload bytes, source preservation and exact image reuse.
• Downloaded and inspected sanitized artifact 10922247261, SHA-256 7899b19b7b20fbdecea441e5273f121f9d31811173f9f456169546c03937cfaf. Artifact expires 2026-10-04; commit/tree and this evidence remain in PR history.
• Astra implementation/review and Luna deployment-check implementation with independent review. Graphify unavailable; no graph refresh claimed.

The initial workflow parse failure was fixed by resolving the report path after runner allocation. Prior head 2d38c4f also passed real container recovery in run 36290702672; final evidence above includes the subsequent health-check changes.

Controlled-trial baseline

release/controlled-trial-2026-09-27 is fixed at the verified final head. Stacked on #47; all prior ancestry/review records preserved. Main and production were not changed.

Boundaries

Synthetic idle-data round-trip only: dedicated recovery code does not certify operational backup/restore scripts, concurrent-write consistency, Redis session continuity, offsite recovery, TLS or operator acceptance. Images were built locally in CI, not published as production artifacts. CI MinIO source image is not a production distribution decision (#35 remains open). Actual rollout still requires target/access and protection-state verification, production object storage, accounting-consumer quiescence, compatible rollback and business/operator acceptance.