fix: restore reviewable migration evidence

tests/deployment/compose_test.go

@@ -0,0 +1,66 @@
+package deployment_test
+
+import (
+	"os"
+	"path/filepath"
+	"regexp"
+	"strings"
+	"testing"
+)
+
+func TestComposeUsesSafeDeploymentDefaults(t *testing.T) {
+	root := filepath.Join("..", "..")
+	compose := readFile(t, filepath.Join(root, "compose.yml"))
+	envExample := readFile(t, filepath.Join(root, ".env.example"))
+
+	for _, required := range []string{
+		`${UPSTREAM_URL:?set UPSTREAM_URL}`,
+		`${CLICKHOUSE_URL:?set CLICKHOUSE_URL with URL-encoded credentials}`,
+		`${CLICKHOUSE_PASSWORD:?set a strong CLICKHOUSE_PASSWORD}`,
+	} {
+		if !strings.Contains(compose, required) {
+			t.Errorf("compose.yml must reject an empty required setting with %q", required)
+		}
+	}
+
+	if !regexp.MustCompile(`(?m)^\s+image: clickhouse/clickhouse-server:\d+\.\d+\.\d+\.\d+-alpine\s*$`).MatchString(compose) {
+		t.Error("ClickHouse image must use an exact version tag")
+	}
+
+	serviceStart := strings.LastIndex(compose, "  thief_clickhouse:")
+	if serviceStart < 0 {
+		t.Fatal("compose.yml is missing the thief_clickhouse service")
+	}
+	clickhouseService := compose[serviceStart:]
+	if strings.Contains(clickhouseService, "\n    ports:") {
+		t.Error("ClickHouse must not publish host ports by default")
+	}
+
+	for _, emptySecret := range []string{"CLICKHOUSE_URL=\n", "CLICKHOUSE_PASSWORD=\n"} {
+		if !strings.Contains(envExample, emptySecret) {
+			t.Errorf(".env.example must leave %q empty", strings.TrimSpace(emptySecret))
+		}
+	}
+}
+
+func TestReviewDocumentsUseStablePaths(t *testing.T) {
+	root := filepath.Join("..", "..")
+	for _, path := range []string{
+		filepath.Join(root, "docs", "compose", "specs", "reliability-security-fixes.md"),
+		filepath.Join(root, "docs", "compose", "plans", "reliability-security-fixes.md"),
+	} {
+		content := readFile(t, path)
+		if !strings.Contains(content, "2026-07-09-clickhouse-migration.md") {
+			t.Errorf("%s must link to the dated source document", path)
+		}
+	}
+}
+
+func readFile(t *testing.T, path string) string {
+	t.Helper()
+	b, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return string(b)
+}