fix: require signature invalidation in live rotation acceptance

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ed7-828d-7ca0-a8d4-0c3e5a0c4102

scripts/verify_preflight_signing_runtime.py

@@ -2,7 +2,6 @@
 """Non-mutating live signing acceptance. Prints metadata and booleans only."""
 import argparse
 import base64
-from datetime import datetime, timedelta, timezone
 import hashlib
 import hmac
 import json
@@ -33,6 +32,8 @@ def main():
     replicas = deployment['spec']['replicas']
     assert replicas > 0 and len(pods) == replicas
     health = json.load(urllib.request.urlopen('http://127.0.0.1:8000/state/health', timeout=20))
+    assert health['status'] == 'ok' and health['db'] == 'connected'
+    assert health['instance_role'] == 'primary' and health['instance_label'] == 'railiance01'
     # Fixture is read-only and is the existing consuming migration's source ID.
     req = urllib.request.Request(
         'http://127.0.0.1:8000/repos/fda8ad85-a7d7-4055-8f21-902a533e59df/rename/preflight',
@@ -59,8 +60,9 @@ _verify_preflight_token(payload['token'])
 if payload['predecessor']:
     try:
         _verify_preflight_token(payload['predecessor'])
-    except RenamePreconditionFailed:
-        pass
+    except RenamePreconditionFailed as error:
+        if str(error) != 'Invalid repository rename preflight token':
+            raise RuntimeError('predecessor_rejection_was_not_signature_invalidation')
     else:
         raise RuntimeError('predecessor_not_invalidated')
 print('verified')