docs: record migration head 0020 in the release manifest and docs

RELEASE_MANIFEST.json still said head 0011 (repo was at 0018, now 0020)
and RELEASE_CANDIDATE_V1.md said 0010. Updated both, plus
AI_PROJECT_STATE.md and PILOT_DEPLOYMENT.md, to head
0020_not_null_timestamps as applied in production.

scripts/release_manifest.py reported the 4-digit file prefix as the head
("0020" instead of "0020_not_null_timestamps") and always read the
applied revision from the dev container. It now asks Alembic for the real
head and revision count, and the Hub container is configurable
(HUB_CONTAINER); the source is recorded in the manifest.

tests/test_release_candidate.py now fails when the manifest head differs
from Alembic's head.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_release_candidate.py

@@ -25,6 +25,19 @@ def test_versions_are_coherent_across_hub_agent_and_packages():
         assert m["GTI_FISCAL_VERSION"] == v and m["migrations"]["alembic_head_in_repo"] == m["migrations"]["applied_revision"]
 
 
+def test_manifest_records_the_real_migration_head():
+    # The manifest said "0011" while the repository was already at 0018: the
+    # generator used the 4-digit file prefix and nothing compared it to Alembic.
+    from alembic.config import Config
+    from alembic.script import ScriptDirectory
+    config = Config(str(ROOT / "central" / "alembic.ini"))
+    config.set_main_option("script_location", str(ROOT / "central" / "alembic"))
+    script = ScriptDirectory.from_config(config)
+    migrations = json.loads((ROOT / "release" / "RELEASE_MANIFEST.json").read_text(encoding="utf-8"))["migrations"]
+    assert migrations["alembic_head_in_repo"] == script.get_current_head()
+    assert migrations["count"] == len(list(script.walk_revisions()))
+
+
 def test_production_compose_never_exposes_postgres_or_dev_token():
     import yaml
     raw = (ROOT / "deploy" / "hub" / "docker-compose.prod.yml").read_text(encoding="utf-8")