fix(vector): harden packaged migrations

scripts/test-vector-migration-image.sh

@@ -0,0 +1,42 @@
+#!/bin/sh
+set -eu
+
+image=${1:?usage: test-vector-migration-image.sh IMAGE [PLATFORM]}
+platform=${2:-${PLATFORM:-linux/arm64}}
+slug=$$
+network="thoth-vector-migration-$slug"
+database="thoth-vector-db-$slug"
+
+cleanup() {
+  docker rm --force "$database" >/dev/null 2>&1 || true
+  docker network rm "$network" >/dev/null 2>&1 || true
+}
+trap cleanup EXIT INT TERM
+
+docker network create "$network" >/dev/null
+docker run --detach --rm --platform "$platform" --name "$database" --network "$network" \
+  -e POSTGRES_DB=thoth -e POSTGRES_USER=thoth_admin -e POSTGRES_PASSWORD=test-only \
+  pgvector/pgvector:pg16 >/dev/null
+
+attempt=0
+until docker exec "$database" pg_isready -U thoth_admin -d thoth >/dev/null 2>&1; do
+  attempt=$((attempt + 1))
+  if [ "$attempt" -ge 30 ]; then
+    echo "pgvector test database did not become ready" >&2
+    exit 1
+  fi
+  sleep 1
+done
+
+database_url="postgresql+psycopg2://thoth_admin:test-only@$database:5432/thoth"
+applied=$(docker run --rm --platform "$platform" --network "$network" \
+  --entrypoint /opt/venv/bin/tht -e THT_VECTOR_ADMIN_URL="$database_url" \
+  "$image" vector migrate --json)
+status=$(docker run --rm --platform "$platform" --network "$network" \
+  --entrypoint /opt/venv/bin/tht -e THT_VECTOR_ADMIN_URL="$database_url" \
+  "$image" vector migrate --status --json)
+
+expected='{"applied": ["001", "002", "003"], "drifted": [], "pending": []}'
+test "$applied" = "$expected"
+test "$status" = "$expected"
+echo "core image vector migration discovery/status smoke passed"

scripts/verify-container-images.sh

@@ -18,6 +18,7 @@ docker buildx build --platform "$platform" --load \
 
 docker run --rm --platform "$platform" --entrypoint /app/docker/smoke/core-smoke.sh \
   "$core_image"
+./scripts/test-vector-migration-image.sh "$core_image" "$platform"
 docker run --rm --platform "$platform" -e BACKEND_BASE_URL=/api \
   "$frontend_image" frontend-config-smoke
 docker run --rm --platform "$platform" -e BACKEND_BASE_URL= \