feat(container): harden v0.1.1 publication

.github/workflows/verify.yml

@@ -14,8 +14,8 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: "3.11"
       - run: python -m pip install "uv==0.11.14"
@@ -25,3 +25,14 @@ jobs:
         run: uv run ruff check --select F,I app/db/migrations.py scripts/image_release.py tests/release
       - name: Validate container contracts without registry writes
         run: uv run pytest -q tests/release
+      - name: Build and smoke exact pull-request or main source image
+        run: |
+          uv run python -c 'from app.db.migrations import migration_inventory; print("\n".join(migration_inventory()))' > migration-inventory.txt
+          printf '%s\n' 'PORTFOLIO_HUB_SECRET_CANARY_DO_NOT_SHIP' > .env.ci-canary
+          RELEASE_VERSION="v$(python -c 'import tomllib; print(tomllib.load(open("pyproject.toml", "rb"))["project"]["version"])')"
+          docker build --platform linux/amd64 --provenance=false \
+            --build-arg "SOURCE_COMMIT=${GITHUB_SHA}" --build-arg "RELEASE_VERSION=${RELEASE_VERSION}" \
+            --tag "portfolio-hub-ci:${GITHUB_SHA}" .
+          uv run python scripts/image_release.py smoke --image "portfolio-hub-ci:${GITHUB_SHA}" --inventory migration-inventory.txt --timeout 180
+          docker save --output portfolio-hub-image.tar "portfolio-hub-ci:${GITHUB_SHA}"
+          uv run python scripts/image_release.py scan --image "portfolio-hub-ci:${GITHUB_SHA}" --archive portfolio-hub-image.tar