fix(migrate): fail the job when migrations remain pending (ENG-565)

[bobodread876]

The other half of ENG-565. Config value: lnflash/deployments#195.

The defect

Every Mongo-touching workload gates on this Job through the wait-for-mongodb-migrate initContainer. That gate is worthless if the Job cannot fail — and it couldn't:

#!/bin/sh
migrate-mongo status
migrate-mongo up      # aborts the whole run on the first throwing migration;
                      # exit code discarded
migrate-mongo status  # always succeeds → script exits 0

No set -e. So prod applied no migration between 2026-03-28 and 2026-08-26 while every deploy reported success. 20260330161656 threw on an empty NOTIFICATION_TOPICS, migrate-mongo stopped, and the two migrations behind it never ran.

It surfaced five months later, in an unrelated PR, as an api pod crash-looping while building the npub unique index whose dedupe migration had never executed.

The fix

• set -eu — a throwing migration now fails the Job directly.
• After up, re-read status; if anything is still PENDING, exit 1. migrate-mongo reporting success while leaving work undone is exactly the case the first change doesn't cover.

A green Job that applied nothing was the real defect. The crash-loop was just the first symptom loud enough to notice.

Notes

• grep is present in the node:24-alpine base (/bin/grep) — verified, not assumed.
• Script passes sh -n.
• Expect this to turn currently-"passing" deploys red where a cluster is behind. That is the point — but it means the first deploy after this merges may fail loudly on any env carrying pending migrations. deployments#195 clears the known ones.

[linear]

ENG-565