fix: make corporate actions atomic and recoverable

tests/release/test_release_contracts.py

@@ -17,6 +17,10 @@ def test_branch_verification_has_no_registry_write_authority_or_path():
     for forbidden in ("packages: write","docker login","docker push","REGISTRY_TOKEN","image_release.py publish"):
         assert forbidden not in text
     assert "uv sync --extra dev --locked" in text and "uv run pytest -q" in text
+    assert "Verify corporate-action atomicity and guarded recovery in PostgreSQL" in text
+    assert "tests/test_corporate_action_atomic_recovery_postgres.py" in text
+    assert "${POSTGRES_PASSWORD}@127.0.0.1:5432/postgres" in text
+    assert "***@" not in text
 
 def test_tag_publication_is_strict_single_build_handoff_without_latest():
     text=PUBLISH.read_text(); verify,publish=text.split("\n  publish:",1)
@@ -58,8 +62,8 @@ def test_release_version_and_migration_contract_has_current_head_0031():
         for path in (REPO / "app/db/alembic/versions").glob("*.py")
         if path.name != "__init__.py"
     )
-    assert 'version = "0.3.2"' in project
-    assert 'app_version: str = "0.3.2"' in config
+    assert 'version = "0.3.3"' in project
+    assert 'app_version: str = "0.3.3"' in config
     assert len(migrations) == 31
     assert migrations[-1].startswith("20260913_0031_")
 
@@ -85,7 +89,7 @@ def test_operations_separate_publication_deployment_migration_and_db_rollback():
         "Image rollback is **not** database rollback",
         "read-only root filesystem",
         "10001:10001",
-        "PortfolioHub v0.3.2 container contract",
+        "PortfolioHub v0.3.3 container contract",
         "v0.2.1 includes migration `0030`",
         "trex-web v0.2.3 displays `strategy_nick`",
     ):