v0.1.7

0.1.7: the stack could never apply, and verify.sh hid the reason

Applied end to end in a real tenancy for the first time. Terraform planned
ten resources cleanly and then the API refused one of them:

  400-InvalidParameter: Internet Gateway target cannot be used together with
  Service Gateway target for All Services in the same routing table

0.1.4 added that service gateway so the database's access-control list could
name the VCN, which Oracle honours only when traffic arrives through one.
But the instance needs the internet gateway to install anything at all, and
OCI will not have both in one route table. Every apply since 0.1.4 would
have failed at exactly this point, after provisioning the database.

The service gateway is gone, and with it the VCN-scoped ACL -- naming the
instance's public IP instead is circular, since cloud-init already carries
the database's connection descriptor. The demo database is now reachable
over TLS with the ADMIN password and nothing else; it is created empty and
destroyed with the stack, adb_allowed_cidrs narrows it, and the README says
so rather than implying a protection that is not there.

verify.sh waited with `oci resource-manager job get --wait-for-state`, a flag
that subcommand does not accept. The non-zero exit tripped set -e and ran the
teardown trap before any diagnostic printed, so a failed job looked like the
script silently skipping three steps. Every wait is now an explicit poll.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PnwqraF2VmmnoTKoNFdSBb