feat(container): harden v0.1.1 publication

tests/release/test_release_contracts.py

@@ -24,15 +24,44 @@ def test_tag_publication_is_strict_single_build_handoff_without_latest():
     assert "ref: ${{ github.sha }}" in text and text.count("docker build ")==1
     assert "docker build" not in publish and "packages: write" not in verify and "packages: write" in publish
     assert "tested-image/scripts/image_release.py publish" in publish and ":latest" not in text
+    assert "--platform linux/amd64" in verify and '--build-arg "RELEASE_VERSION=${GITHUB_REF_NAME}"' in verify
     for name in ("portfolio-hub-image.tar","portfolio-hub-image.tar.sha256","portfolio-hub-image.id","migration-inventory.txt"):
         assert name in text
 
 def test_dockerfile_python311_locked_non_root_explicit_uvicorn_and_resources():
     text=(REPO/"Dockerfile").read_text()
-    assert text.count("FROM python:3.11-slim")==2 and "uv sync --locked --no-dev --no-editable" in text
+    assert text.count("FROM python:3.11-slim@sha256:")==2 and "uv sync --locked --no-dev --no-editable" in text
+    assert "FROM ghcr.io/astral-sh/uv:0.11.14@sha256:" in text
+    assert text.startswith("# syntax=docker/dockerfile:1@sha256:")
     assert "USER 10001:10001" in text and 'CMD ["uvicorn", "app.main:app"' in text
     assert "COPY app/ ./app/" in text and "COPY ." not in text
     assert "org.opencontainers.image.source" in text and "org.opencontainers.image.revision" in text
+    assert "org.opencontainers.image.version" in text and "ARG RELEASE_VERSION" in text
+
+
+def test_workflow_actions_are_commit_pinned_and_verify_version_is_project_derived():
+    for workflow in (PUBLISH, VERIFY):
+        for line in workflow.read_text().splitlines():
+            if "uses: actions/" in line:
+                revision = line.split("@", 1)[1].split()[0]
+                assert len(revision) == 40 and all(char in "0123456789abcdef" for char in revision)
+    verify = VERIFY.read_text()
+    assert "tomllib" in verify and 'RELEASE_VERSION=${RELEASE_VERSION}' in verify
+    assert 'RELEASE_VERSION=v0.1.1' not in verify
+
+
+def test_release_version_and_migration_contract_are_v011_head_0029():
+    project = (REPO / "pyproject.toml").read_text()
+    config = (REPO / "app/core/config.py").read_text()
+    migrations = sorted(
+        path.name
+        for path in (REPO / "app/db/alembic/versions").glob("*.py")
+        if path.name != "__init__.py"
+    )
+    assert 'version = "0.1.1"' in project
+    assert 'app_version: str = "0.1.1"' in config
+    assert len(migrations) == 29
+    assert migrations[-1].startswith("20260814_0029")
 
 def test_dockerignore_is_deny_by_default_required_inputs_only():
     lines=(REPO/".dockerignore").read_text().splitlines(); assert lines[0]=="**"