G0~G8 성과·동맹 측정 OS 작업 일괄 고정

8월 7일까지 워킹트리에만 남아 있던 미커밋 작업을 커밋한다. 여러 사본
폴더(worktree·clone)에 흩어져 있던 중간 스냅샷을 정리하기 전에 원본을
git 이력으로 고정하는 것이 목적이다.

- contracts/routes/services: measurement, outcome_trajectory, rupture_repair,
  deliberate_practice, calibration_transfer, supervision_research,
  multimodal_alliance, continuous_improvement 계열 신규 모듈과 테스트
- infra/db/init: 07~16 마이그레이션(측정 기반~calibration transfer 실행)
- apps/web: 세션 리뷰 카드·관리 화면·E2E 스펙 추가
- docs/ops: G0~G8 라이브 통합·배포·롤백 증거 문서와 evidence JSON/PNG
- scripts: smoke·ledger·릴리스 에이전트·NAS 프리뷰 운영 스크립트

engine.public 로그 .bak과 apps/web/test-results 산출물은 커밋에서 제외했다.

scripts/test_backup_vignette_db.py

@@ -0,0 +1,77 @@
+from __future__ import annotations
+
+import re
+import shutil
+import subprocess
+import unittest
+from pathlib import Path
+
+
+BACKUP_SCRIPT = Path(__file__).with_name("backup-vignette-db.ps1")
+
+
+class BackupVignetteDatabaseTest(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls) -> None:
+        cls.source = BACKUP_SCRIPT.read_text(encoding="utf-8")
+
+    def test_uses_custom_dump_and_verifies_toc_before_publish(self) -> None:
+        dump_index = self.source.index("'pg_dump'")
+        verify_index = self.source.index("'pg_restore', '--list'")
+        publish_index = self.source.index(
+            "Move-Item -LiteralPath $partialPath -Destination $finalPath"
+        )
+        self.assertLess(dump_index, verify_index)
+        self.assertLess(verify_index, publish_index)
+        self.assertIn("'--format=custom'", self.source)
+        self.assertIn("'--no-owner'", self.source)
+        self.assertIn("'--no-privileges'", self.source)
+
+    def test_manifest_binds_dump_to_hash_and_container(self) -> None:
+        for expected in (
+            "container_id = $containerId",
+            "size_bytes = (Get-Item -LiteralPath $finalPath).Length",
+            "sha256 = $sha256",
+            "verified_with = 'pg_restore --list'",
+        ):
+            self.assertIn(expected, self.source)
+        self.assertIn("Get-FileHash -LiteralPath $partialPath -Algorithm SHA256", self.source)
+
+    def test_never_removes_database_container_or_volume(self) -> None:
+        forbidden = (
+            r"(?im)^\s*(?:&\s*)?docker(?:\.exe)?\s+(?:container\s+)?rm\b",
+            r"(?im)^\s*(?:&\s*)?docker(?:\.exe)?\s+volume\s+(?:rm|prune)\b",
+            r"(?im)^\s*(?:&\s*)?docker(?:\.exe)?\s+compose\s+down\b",
+        )
+        for pattern in forbidden:
+            self.assertIsNone(re.search(pattern, self.source), pattern)
+        self.assertIn("rm -f $containerTempPath", self.source)
+
+    def test_windows_powershell_51_parser_accepts_script(self) -> None:
+        powershell = shutil.which("powershell.exe")
+        if powershell is None:
+            self.skipTest("Windows PowerShell 5.1 is unavailable")
+        escaped_path = str(BACKUP_SCRIPT.resolve()).replace("'", "''")
+        command = (
+            "$tokens=$null; $errors=$null; "
+            "[System.Management.Automation.Language.Parser]::ParseFile("
+            f"'{escaped_path}', [ref]$tokens, [ref]$errors) | Out-Null; "
+            "if ($errors.Count -gt 0) { "
+            "$errors | ForEach-Object { Write-Error $_.Message }; exit 1 }; exit 0"
+        )
+        completed = subprocess.run(
+            [powershell, "-NoProfile", "-Command", command],
+            check=False,
+            capture_output=True,
+            text=True,
+            encoding="utf-8",
+        )
+        self.assertEqual(
+            completed.returncode,
+            0,
+            msg=f"stdout={completed.stdout}\nstderr={completed.stderr}",
+        )
+
+
+if __name__ == "__main__":
+    unittest.main()