- deletion flow emitted job/instance envelopes before the transaction that
closed the job rows; subscribers refetching on the notification saw
status 'running' with no further event. Emits now happen after commit,
including the failure path
- interrupted-deletion sweep now emits job envelopes with the job's real
request_id (it previously stayed silent while the secure-execution sweep
already emitted)
- verified during the sweep: backup restore validation re-derives the
expected schema via migrateDatabase, so migration 18 is automatically
covered; no tables reference audit_events or operation_preparations, so
the retention deletes cannot trip FK constraints