fix: update DB migration documentation and enhance verification script

- Added a note in `DB-MIGRATIONS.md` to clarify that `verify` should not be run before `migrate`.
- Modified `verify-bootstrap-contract.sh` to check for a non-negative integer count of `management_user` instead of just existence, improving error handling for database queries.

Author: mitchdowney

docs/development/DB-MIGRATIONS.md

@@ -94,6 +94,8 @@ For disposable environments (e.g. alpha), reset schema via ops jobs only:
 5. `metaboost-db-verify-bootstrap-contract`
 6. `metaboost-management-superuser-create`
 
+**Do not run verify before migrate.** Rebootstrap only restores roles/grants; `linear_migration_history` and application tables are created by the migrate jobs (steps 3–4). Verify before migrate fails with `linear_migration_history exists expected 't' but got 'f'`.
+
 Then rollout-restart API workloads. Scale down app tiers first if you want a quiet cutover.
 
 From repo root (waits for each job):

infra/k8s/base/ops/source/database/runner/verify-bootstrap-contract.sh

@@ -111,9 +111,12 @@ check_database_contract() {
   assert_positive_int "${label}: read linear_migration_history row count" "$ro_history_count"
 
   if [[ "$label" == "management" ]]; then
-    local can_query_management_user
-    can_query_management_user="$(run_query "$read_write_password" "$read_write_role" "$db_name" "SELECT EXISTS (SELECT 1 FROM management_user LIMIT 1);")"
-    assert_equals "${label}: read_write can query management_user" "$can_query_management_user" "t"
+    local management_user_count
+    management_user_count="$(run_query "$read_write_password" "$read_write_role" "$db_name" "SELECT count(*) FROM management_user;")"
+    if ! [[ "$management_user_count" =~ ^[0-9]+$ ]]; then
+      echo "ERROR: ${label}: read_write cannot query management_user (expected a non-negative integer count)." >&2
+      exit 1
+    fi
   fi
 }