ci: enforce production-safe database migrations

.gitea/workflows/release-ci.yml

@@ -53,6 +53,10 @@ jobs:
           test ! -f .git/shallow
           test "$(git rev-parse HEAD)" = "$CI_SHA"
           git merge-base --is-ancestor "$CI_SHA" refs/remotes/origin/main
+      - name: Verify production migration safety
+        run: |
+          production_base=$(cat deploy/ci/production-migration-base)
+          node ./scripts/ci-validate-migrations.mjs "$production_base"
       - name: Verify Go formatting
         run: |
           unformatted=$(gofmt -l apps/api)
@@ -77,8 +81,10 @@ jobs:
           docker-compose -f docker-compose.yml config --quiet
           shellcheck scripts/ci-build-images.sh scripts/ci-validate-semver.sh \
             scripts/provision-ci-runner.sh tests/ci/ci-build-images-test.sh \
-            tests/ci/pipeline-test.sh tests/ci/semver-test.sh
+            tests/ci/migrations-test.sh tests/ci/pipeline-test.sh \
+            tests/ci/semver-test.sh
           ./tests/ci/ci-build-images-test.sh
+          ./tests/ci/migrations-test.sh
           ./tests/ci/pipeline-test.sh
           ./tests/ci/semver-test.sh
       - name: Scan repository