Production schema changes run only through the numbered Alembic revisions in versions/.
Runtime code must not invoke metadata.create_all(). CHECKSUMS.sha256 pins every applied
revision; deployment verifies it before alembic upgrade and uses the revision's downgrade()
for rollback. Tests may create the same metadata in a temporary SQLite database.