fix(worker): bug-bash — forwarder batch halt, restore finalize ctx, deploy email slug - #77

…ctx, deploy email slug

Three bugs from the 2026-06-02 platform bug bash:

- event_email_forwarder: the unsubscribe fail-CLOSED branch used `continue`
  instead of `break batchLoop`. Because the cursor is advanced per-row inline
  (unconditional Set, not max), a later sendable row in the same batch advanced
  the watermark PAST the held row — stranding it forever and silently dropping
  a legitimate transactional email during a transient unsubscribe-lookup DB
  blip. Now halts the batch like the SendClassTransient case. Adds a multi-row
  regression test (the single-row test couldn't distinguish continue/break).

- customer_restore_runner: the finalize UPDATE used parentCtx, so a worker
  shutdown (rolling deploy / drain) after pg_restore succeeded would fail the
  UPDATE and mark a SUCCESSFUL restore as 'failed'. Now uses a fresh
  context.Background()+10s like the customer_backup_runner P2-W4 fix.

- lifecycle_emails (deploy.created/healthy, shipped earlier today): the opaque
  8-char hex app_id slug was rendered as a prose deployment "name" in the
  subject. Now shown only as a labeled `App` identifier in the body (the live
  URL identifies the app); subjects are generic. Mirrors the deploy-TTL
  builders that deliberately avoid app_id-as-name.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>