fix(workflows): retire deleted definitions atomically

[ngthuydiem]

Summary

Workflow deletion succeeds but leaves its definition visible in get and list. Commit the signed deletion, definition retirement, and executable-row removal together. Lock against concurrent definition writes, preserve newer definitions, and let retries repair old orphan definitions.

Review order: relay workflow_deletion::persist recognizes a UUID deletion → database delete_in_transaction retires both rows → the relay commits and invalidates caches. Legacy name deletion, already-running actions, and bulk cleanup remain outside this change.

Related issue

Related: #717 and #2879. Overlaps unmerged proposals #4234 and #6639.

Testing

Compare local baseline 213092074 with 0322e9975, using dedicated accounts and an isolated relay. Both HTTP regressions fail on the baseline and pass on the patch:

Journey	Before	After
Delete → get/list	Definition remains	Definition absent
Older delete → trigger newer workflow	Workflow not found	Newer workflow still runs

Run cargo test -p buzz-test-client --test e2e_workflow_deletion -- --ignored --test-threads=1 with the test's documented fixture variables. Two HTTP tests cover visibility, authorization, replay, and execution. Four Postgres tests cover rollback, orphan cleanup, tenant/owner boundaries, timestamp ordering, writer locking, and scheduled-claim denial.

Two cron workflows each fired before deletion. After delete/retry and relay restart, both remained absent and produced no new messages over 133 seconds. CLI/relay evidence only; native UI was not tested.

Validation gaps: Full affected-package checks still fail in observability_source (also reproduced on the baseline) and relay demo_join_forwarded_arm_round_trips_echo. The full isolated Postgres suite has 253 passes and four existing push-matcher failures; all four deletion regressions pass. just ci passes static checks but fails ACP keepalive/configuration tests; later build/test phases remain unvalidated. The prior head also has failing GitHub checks, including profile-status smoke; this draft is not merge-ready. The fixed-container just test recipe was replaced with full affected-package suites and isolated Postgres/live-relay checks to preserve test isolation.

Generated with Codex

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is 6dfd145cde4bf0d45091de1cc5e6c7e3462d5703...0322e99756e34286393eb8881c667af163a33703.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review 0322e99756e34286393eb8881c667af163a33703 to authorize a new review.
Any previous review applies only to its recorded range.