Fix six low-severity issues from the full-session code review

- PricingEngine::round_to_99(): ceil($price) - 0.01 undershoots whenever
  $price's cents are already .99 or higher — an exact integer (ceil()
  equals floor(), landing a full cent below $price) or, more subtly, any
  fractional price above X.99 itself (a division result, not something
  pre-rounded to 2 decimals, e.g. 20.995 -> old formula gave 20.99, below
  the input). Rewritten as floor()+0.99, bumped by 1 if still under $price.
  Verified against 8 cases including both boundary classes: every result
  now >= its input.

- CoverSync::attach_cover(): wp_generate_attachment_metadata()'s return
  value was never checked. Assumed it'd return empty on failure — verified
  directly it does NOT: fed it 2000 bytes of garbage and got back
  ['filesize' => 2000], no width/height, since GD/Imagick couldn't decode
  it. Old code would report "attached" for a degraded image with no
  dimensions/srcset. Now checks for width+height specifically, and cleans
  up the orphaned attachment on failure so a re-run retries the product.
  Verified both the corrupt-image rejection (no orphan left, no thumbnail
  set) and that a real image still attaches normally.

- Makefile: the per-invocation .env.$(ENV).compose file (holds every API
  key and both DB passwords, stripped of DB_PASSWORD/DB_ROOT_PASSWORD only)
  was never cleaned up, left at default 644 in the repo root after every
  `make` command. Now chmod 600 on creation and removed at the end of every
  target, preserving the underlying command's exit code through the
  cleanup. Verified both the happy path (file gone after, exit 0) and the
  failure path (bad ENV: file still cleaned up, real exit code still
  propagates through make).

- docker-compose.yml: added a healthcheck to the wordpress service (bash's
  /dev/tcp against php-fpm's port 9000 — no HTTP endpoint to hit directly,
  and no `nc` in this image; verified it correctly succeeds once php-fpm is
  listening and fails against a closed port) and switched cron's and
  caddy's depends_on (across all three env overlays) from bare
  container-started to condition: service_healthy. Previously both could
  start against a wordpress container that had started but wasn't actually
  ready yet. Verified via a full down/up cycle: db+redis healthy, then
  wordpress starts and becomes healthy, only then do cron and caddy start.

- .env.dev/.env.staging/.env.production chmod'd 600 (were 644) — same
  plaintext-credential content as secrets/<env>/, which is already 700/644
  at the directory/file level respectively for a different reason (container
  UID readability); these have no such constraint, only the host CLI reads
  them. Also removed a stray .env.staging.compose left over from before the
  Makefile fix above existed. Noted the convention in .env.example so newly
  created env files follow it too.

wp-content/plugins/bookstore-core/includes/Pricing/PricingEngine.php

@@ -26,9 +26,24 @@ class PricingEngine
         return self::round_to_99($raw);
     }
 
+    /**
+     * Smallest X.99 that is still >= $price — never below it, since this
+     * exists to preserve the margin calculate_retail_price() just computed.
+     * ceil($price) - 0.01 (the previous formula) gets this wrong whenever
+     * $price's cents are already .99 or higher: an exact integer (ceil()
+     * equals floor() there, so the result lands a full cent BELOW $price)
+     * or, more subtly, any fractional price above X.99 itself (arithmetically
+     * possible — this is a division result, not something pre-rounded to 2
+     * decimals, e.g. $price = 20.995 -> old formula gave 20.99, which is
+     * below $price).
+     */
     public static function round_to_99(float $price): float
     {
-        return ceil($price) - 0.01;
+        $candidate = floor($price) + 0.99;
+        if ($candidate < $price) {
+            $candidate += 1;
+        }
+        return round($candidate, 2);
     }
 
     /** Null if the work has no currently sellable offer (design doc §03: fulfillment resolved at render time). */

wp-content/plugins/bookstore-core/includes/Product/CoverSync.php

@@ -98,6 +98,23 @@ class CoverSync
         }
 
         $metadata = wp_generate_attachment_metadata($attachment_id, $upload['file']);
+        // A corrupt/truncated image can pass fetch_and_verify()'s
+        // content-type + byte-size checks (not full JPEG validation) yet
+        // still fail here. Confirmed directly: for unreadable image bytes,
+        // wp_generate_attachment_metadata() does NOT return an empty array —
+        // it returns something like ['filesize' => 2000] with no width/
+        // height, since GD/Imagick couldn't decode it. empty() alone misses
+        // this; width/height (present on any image WordPress actually
+        // decoded) is the real signal. Left unchecked, set_post_thumbnail()
+        // below would still succeed (the attachment post itself is valid),
+        // silently reporting "attached" for a degraded image with no
+        // width/height/srcset. Clean up and count it as missed instead, so a
+        // re-run retries this product rather than has_post_thumbnail()
+        // treating the broken attachment as done.
+        if (empty($metadata) || !isset($metadata['width'], $metadata['height'])) {
+            wp_delete_attachment($attachment_id, true);
+            return false;
+        }
         wp_update_attachment_metadata($attachment_id, $metadata);
 
         return (bool) set_post_thumbnail($product_id, $attachment_id);