fix: require cloud chart sync and deployed revision

tests/test_production_health_smoke.py

@@ -26,3 +26,15 @@ def test_production_smoke_accepts_health_degraded_status(monkeypatch) -> None:
 
     assert report["ok"] is True
     assert report["checks"][1]["health_status"] == "blocked"
+
+
+def test_production_smoke_requires_the_expected_deployment_sha(monkeypatch) -> None:
+    def fake_fetch(url: str, timeout: float) -> tuple[int, str, float]:
+        if url.endswith("/api/health"):
+            return 200, '{"status":"ok","deployment":{"gitCommit":"old-sha"}}', 0.01
+        return 200, "Jyotisha", 0.01
+
+    monkeypatch.setattr("scripts.production_smoke.fetch", fake_fetch)
+    report = check("https://example.invalid", 1.0, expected_git_sha="new-sha")
+    assert report["ok"] is False
+    assert report["checks"][1]["deployment_git_commit"] == "old-sha"

tests/test_supabase_profile_migration_workflow.py

@@ -17,7 +17,7 @@ def test_profile_migration_workflow_is_manual_and_uses_vps_env_without_printing_
     assert "cat \"$SQL_FILE\" |" in text
 
 
-def test_profile_migration_workflow_targets_only_account_profile_migrations() -> None:
+def test_profile_migration_workflow_includes_chart_library_and_birth_time_profile_migrations() -> None:
     text = WORKFLOW.read_text(encoding="utf-8")
 
     assert "20260718010000_recover_missing_profile_rows.sql" in text
@@ -25,3 +25,5 @@ def test_profile_migration_workflow_targets_only_account_profile_migrations() ->
     assert "20260718050000_profiles_service_role_upsert_grants.sql" in text
     assert "20260718070000_profiles_service_role_upsert_id.sql" in text
     assert "20260718080000_profiles_service_role_account_upsert_selects.sql" in text
+    assert "20260718100000_repair_missing_chart_profiles.sql" in text
+    assert "20260718103000_profile_birth_time_declaration_grants.sql" in text