fix: serialize Tower migration validation

scripts/deploy_tower.sh

@@ -51,6 +51,30 @@ docker compose -f docker-compose.unraid.yml config >/dev/null
 docker build --build-arg GEOINTEL_INSTALL_AI="$GEOINTEL_INSTALL_AI" -f deploy/unraid/Dockerfile.all-in-one -t geointel-all-in-one:latest .
 bash deploy/unraid/run-dockerman-container.sh
 
+wait_for_geointel_health() {
+  local status=''
+  for attempt in $(seq 1 90); do
+    status="$(docker inspect --format '{{if .State.Health}}{{.State.Health.Status}}{{else}}{{.State.Status}}{{end}}' geointel 2>/dev/null || true)"
+    if [[ "$status" == 'healthy' ]]; then
+      echo "GeoIntel container is healthy after attempt $attempt."
+      return 0
+    fi
+    if [[ "$status" == 'unhealthy' || "$status" == 'exited' || "$status" == 'dead' ]]; then
+      echo "GeoIntel container entered terminal state: $status" >&2
+      docker logs --tail 120 geointel >&2 || true
+      return 1
+    fi
+    sleep 2
+  done
+  echo "GeoIntel container did not become healthy (last state: ${status:-missing})." >&2
+  docker logs --tail 120 geointel >&2 || true
+  return 1
+}
+
+# Container startup owns the migration. Waiting here prevents the validation
+# smoke from racing a concurrent `alembic upgrade head` against the same DB.
+wait_for_geointel_health
+
 if [[ -x scripts/live_migration_smoke.sh ]]; then
   LIVE_SMOKE_CONTAINER=geointel bash scripts/live_migration_smoke.sh
 fi