feat(container): harden v0.1.1 publication

tests/test_cli.py

@@ -783,14 +783,29 @@ def test_cli_write_command_can_abort() -> None:
     assert repo._portfolio is None
 
 
-def test_cli_health_check_reports_repository() -> None:
+def test_cli_health_check_reports_repository(monkeypatch) -> None:
     repo = FakeRepo(_portfolio())
     runner = build_runner(repo)
+    monkeypatch.setattr(health_commands, "current_revision", lambda _settings: "20260814_0029")
+    monkeypatch.setattr(health_commands, "head_revision", lambda _settings: "20260814_0029")
 
     result = runner.invoke(runner.app, ["health-check"])
 
     assert result.exit_code == 0
     assert "repository: FakeRepo" in result.stdout
+    assert "database_revision: 20260814_0029" in result.stdout
+
+
+def test_cli_health_check_rejects_database_behind_packaged_head(monkeypatch) -> None:
+    repo = FakeRepo(_portfolio())
+    runner = build_runner(repo)
+    monkeypatch.setattr(health_commands, "current_revision", lambda _settings: "20260715_0028")
+    monkeypatch.setattr(health_commands, "head_revision", lambda _settings: "20260814_0029")
+
+    result = runner.invoke(runner.app, ["health-check"])
+
+    assert result.exit_code == 1
+    assert "is not packaged head" in result.stdout
 
 
 def test_cli_init_db_reports_created(monkeypatch) -> None: