- Add is_ignored=0 filter to GetUnnotifiedReleases query per spec section 4.4
(notification lifecycle must exclude ignored releases)
- Add FK constraint on notifications_sent.rgid referencing external_releases(rgid)
per spec schema definition
- Wrap migration application + recording in transactions for atomicity
- Add config.yaml to .gitignore to prevent accidental secret commits
- Pin Dockerfile base image to alpine:3.21 and add non-root appuser
- Add test TestGetUnnotifiedReleases_IgnoredExcluded
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>