fix(purchase): close two narrow double-buy windows on finalize and legacy retries #1232

Two narrow double-buy risks on the purchase path, found in independent reviews of #1111 and #1110. Both predate those PRs.

1. Unguarded failed write in finalizePurchaseStatus (internal/api/handler_purchases.go, ~3101; disclosed in #1111's body). After the approval email is sent, finalizePurchaseStatus writes failed over the just-inserted pending row with no status guard. If a session approve lands while the email is being sent, the row can end up failed for a commitment that was actually bought. That row is then eligible for retry, which risks buying it again. Fix: guard the write on status = 'pending', like the CAS-guarded saves in #1111, and treat a lost guard as a no-op with a log line. Add a race test with approve landing during the send.

2. Retry of legacy EC2 executions without Details (#1110 review). recommendation_identity.go:30-33 reads an EC2 rec with empty Details as the known variant {az, "", ""} rather than unknown. The retry path (handler_purchases.go:2541) builds suppressions from persisted recs without re-matching them. A failed execution saved before Details existed (#453) would therefore leave the stored Linux/UNIX rec unsuppressed after a retry. Fix: treat empty EC2 Details as unknown, which means suppressing every variant, or re-match before building suppressions. Add a test with a legacy row.