geenforce re-publish FK fix (MySQL) + payload-count guard

tests/test_plugins/test_geenforce_display_seed.py

@@ -115,6 +115,11 @@ def test_seed_draft_is_idempotent(db):
 
     entries = ManifestEntry.query.filter_by(scopeid=second['scopeid']).all()
     assert len(entries) == 6
+    # Exactly two inline payloads (dispatcher + always-on) exist after a rebuild,
+    # not more - a payload-count invariant. (The underlying re-publish FK crash
+    # only reproduces on MySQL, which enforces the manifestpayloads FK; it was
+    # verified there directly. SQLite does not enforce it.)
+    assert ManifestPayload.query.count() == 2
 
 
 def test_build_manifest_has_no_smb_exe_payloads(db):