Service fixes found by the first real deployment

Three defects the test suite could not have caught, because each needed a real
cluster, a mounted secret, or a live PostgreSQL.

env.py read database_url rather than resolved_database_url. `configured` was
true because a file was set, and the field it then read was empty — so Alembic
received an empty URL and the migration could never run in the cluster. The
value is also now escaped for ConfigParser interpolation, since a `%` in a
generated password would otherwise raise at credential rotation, which is the
worst time to find out.

SET ROLE opened an implicit transaction that Alembic then nested inside rather
than owning, so it never committed and leaving the connection block rolled
everything back. Alembic logged "Running upgrade" for every revision against a
database that stayed empty. SET ROLE is session-scoped, so committing
immediately ends the implicit transaction without discarding the role.

A missing optional publish-token file was treated as a hard failure. The
absence is the documented read-only posture — the secret is mounted optional
and deliberately not issued — so treating it as a fault turned an intended
state into a 500 rather than the 503 that explains it. `required` now separates
the two cases: a missing database URL still fails loudly, because there the
silence would hide a real fault.

Migrations also assume the durable owner role rather than creating objects as
the leased migration login, per the rapp-postgres database-owner boundary. The
role name is validated against an identifier pattern because SET ROLE cannot be
parameterised.

Service tests 36 -> 47.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Bjefh8NUiEiahN4JLwoSKM

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 388925@bnt-lap001
Assistant-Session: 3507023f-e0fd-4a1e-9d90-a0d4217d1502

service/README.md

@@ -152,6 +152,29 @@ properties of the deployment rather than of this process, and belong to
 `--expect-migration` matters: without it the check can only confirm the schema
 is stamped at all, and it says so rather than implying it verified the head.
 
+## Deployed
+
+Running on railiance01 since 2026-09-08 via `rapp-canned-prompts`, image tag
+0.1.4, schema at alembic `0002`, read-only by design.
+
+Four defects surfaced during that first rollout that the test suite could not
+have caught, because each needed a real cluster, a mounted secret, or a live
+PostgreSQL:
+
+- `env.py` read `database_url` rather than `resolved_database_url`, so the
+  migration could not run where the credential is a file;
+- `SET ROLE` opened an implicit transaction that Alembic then **nested inside
+  rather than owning**, so every revision logged as applied and was rolled
+  back — success reported against an empty database;
+- a missing *optional* publish-token file was treated as a hard failure, so the
+  documented read-only posture returned 500 instead of an explanatory 503;
+- and separately in the rapp, an egress NetworkPolicy that did not select the
+  migration Job at all.
+
+Each now has a regression test. The transaction one is the most worth knowing:
+touching an Alembic connection before Alembic does changes who owns the
+transaction, and the failure is silent in both directions.
+
 ## Status
 
 `CANP-WP-0006` is complete: skeleton and health surface, tenant-keyed schema