fix(worker): bug-bash batch — email-forwarder drop, unbounded queries, lease/ctx safety

[mastermanas805]

Summary

Bug-bash batch for the worker. One genuine open bug fixed (BUG 2); the other findings were verified already-fixed or intentional in current master and are documented below so they aren't re-reported.

Fixed — BUG 2 (HIGH): unbounded SELECT in orphan_sweep_reconciler.fetchLiveStackIDs

fetchLiveStackIDs loaded the entire stacks table into one result set/allocation (SELECT id::text FROM stacks). Replaced with keyset pagination (WHERE id::text > $1 ORDER BY id::text ASC LIMIT $2, batches of orphanLiveIDsBatchLimit = 1000).

• The complete live-id set is still returned — PASS 5 must see every live id to avoid deleting a live namespace — but it's assembled incrementally so the server-side cursor + per-fetch memory stay bounded as the table grows.
• Keyset (not OFFSET): rides the PK index, stable under concurrent inserts/deletes mid-sweep. A stack inserted during the sweep can only ever preserve a namespace, never wrongly delete one.

Tests added (fetchLiveStackIDs now 100% covered):

• TestOrphanSweep_FetchLiveStackIDs_KeysetPagination — full page 1 (== limit) forces a second query whose cursor arg $1 == page 1's tail id; both pages merge into the set.
• TestOrphanSweep_FetchLiveStackIDs_SecondPageError — a DB error on a later page propagates (no partial set).
• TestOrphanSweep_FetchLiveStackIDs_RowsErr — a rows.Err() mid-stream propagates.
• Updated the four existing PASS 5 / fetch-stack-ids query expectations to the new SQL.

Not changed — already fixed / intentional in master

Brief item	Finding
BUG 1 — event_email_forwarder missing-renderer drop	Already fixed. Master writes a forwarder_sent permanent_drop ledger row before advancing the cursor (event_email_forwarder.go ~740-773), covered by TestEventForwarder_MissingRenderer_LoudErrorDropAndAdvance. The brief described pre-fix behavior.
propagation_runner lease	Already fixed (D22-P3, 2026-05-21): pickEligible bumps next_attempt_at by propagationLeaseDuration inside the pick transaction — the crash-safe lease requested.
customer_backup_runner finalize ctx	The fresh context.Background() is the P2-W4 fix (2026-05-18), not a bug. Using parentCtx would re-strand the row at running mid-shutdown after the S3 object is durable — reverting reintroduces the documented bug.

Skipped — behavior-changing / non-trivial

• billing_reconciler keyset: LIMIT 100 is an intentional per-tick Razorpay-rate-limit fan-out cap, not a pure memory bound. Keyset-draining all teams per tick changes documented fan-out behavior — out of scope for a clean batch.
• orphan_sweep PASS 6 timeout: the per-namespace timeout derives from the job ctx and fails-open by design; job-level time budgeting is governed by River JobTimeout. Restructuring the sweep's time budget is non-trivial.

Gate

make gate green (build + vet + go test ./... -short -count=1, the exact CI deploy.yml test step). All 16 packages pass.

🤖 Generated with Claude Code