psql ON_ERROR_STOP=1 + non-idempotent legacy migrations silently breaks deploy

Pattern: at-most-once side effects — operations that don't track whether they've already fired