fix(workflow): stop deleted workflows from returning after a stale edit

[BradGroux]

Fixes #2390.

What users saw

A deleted workflow could return after someone edited a stale copy. A later delete removed the workflow row again, but the replacement definition could remain queryable on the relay.

What changed

Canonical workflow deletion now uses one database transaction that:

• acquires the coordinate-scoped PostgreSQL advisory lock used by kind:30620 replacement writes;
• deletes the exact workflow row;
• tombstones all live definitions for the exact community, owner, and d tag;
• commits the row deletion and event tombstones together;
• returns every affected definition channel so relay query caches are invalidated even when the workflow row was already gone.

The last point closes an orphan-repair gap found during this refresh. Previously the database could tombstone orphaned definitions successfully while returning no workflow-row channel, leaving stale query results in another affected channel cache.

Safety and scope

The existing validator still proves signer authority. The database mutation independently scopes the row and definitions by community and owner.

This PR does not add a permanent resurrection ban, sweep legacy name aliases, or change Desktop refetch behavior. It complements rather than replaces the separate work on atomic deletion, legacy/name no-op handling, and effective agent-author attribution.

Verification

Verified at exact head ea5729ef8e8c69b01de80108c3cf4dc25c233aa8, rebased onto current main:

• Full buzz-db, buzz-relay, and buzz-test-client package suites were exercised. The non-database tests passed; nine unrelated relay media/admin tests failed because this host's local PostgreSQL pool timed out.
• A serial relay rerun confirmed the same unavailable-database boundary rather than a concurrency-dependent code failure.
• Strict affected-package Clippy and Rust formatting passed.
• Lifecycle coverage asserts orphan cleanup returns all affected channel IDs for cache invalidation.

The new lifecycle regression compiled but remains ignored without working local database infrastructure. Live relay and PostgreSQL race tests were not rerun in this refresh.

[BradGroux]

I rebased this branch onto current main and traced the orphan-repair path through the relay cache rather than assuming a successful database delete completed the job.

The core transaction remains relevant. The audit found one remaining defect: when the workflow row was already missing but live definitions still existed, the database tombstoned those definitions yet returned no row channel. The relay therefore had no cache key to invalidate, so a stale query result could survive a successful orphan cleanup.

Head ea5729ef8e8c69b01de80108c3cf4dc25c233aa8 returns the complete set of affected definition channels plus the workflow-row channel, deduplicates them, and invalidates each cache. The lifecycle regression now covers the orphan-definition-only case.

The affected package suites, strict Clippy, and Rust formatting were refreshed. The non-database tests passed. Nine unrelated relay media/admin tests could not obtain this host's local PostgreSQL pool, and a serial rerun hit the same boundary. The new ignored lifecycle regression compiled, but I am not presenting the unavailable database run as passing evidence. This remains intentionally separate from legacy alias policy, Desktop refetch behavior, and the other deletion/attribution PRs noted in the updated body.

[BradGroux]

Rebased this branch onto current block/buzz main at c55e421a0.

Head moved from 0c36797ad to 7345b8420. git range-diff shows the workflow tombstone patch is unchanged, and the branch now has a direct merge base with current main.

Verification:

• The full buzz-db suite passed: 94 tests passed; 153 Postgres-backed tests remained explicitly ignored.
• All 5 branch-specific relay side-effect tests passed.
• The workflow-deletion E2E target compiled and remained explicitly ignored because no relay service was running.
• A broad relay-library run was not fully green in this local environment: 9 Postgres-backed failures reproduced on an exact main baseline with no Postgres service available. The one additional global tracing-order failure from the first branch run passed in an isolated rerun with RUST_LOG unset.
• git diff --check, DCO trailer checks, and the direct merge-base audit passed.

GitHub checks are rerunning on the new head.