fix: fence org lifecycle status and lease writes - #2317

🟢 Confidence 10/10 · safe to merge. Every fence and lease is pinned by a PGlite test at the state boundary it guards, and nothing outside those writes changed.
_{no findings · tests covered · risk high · 4/4 new units observable}

Each lifecycle write now states the state it expects: schema apply fences on its run id, post-merge settle on its lease, reward finalize on its reservation, repo sync status on an active repo in the prior state. All paths are pinned by PGlite tests. The open VcsQueueError/GithubAppError reports are untouched.

• Schema apply progress, stamp and failure writes fence on the claimed workflow_instance_id, with a 5-minute heartbeat
• updateRepoSyncStatus requires an active repo in one of the caller's expected sync states
• finalizeRewardClaim/releaseRewardClaim clear only the reservation they took
• Post-merge settle requires waiting plus the examination's lease

Before merge

• Manual · Expect a schema apply in flight at deploy time to fail on its payload; the org re-applies after the 30-minute stale window

Production impact

_{c4edac2 · Reply "won't fix" to dismiss a finding, or mention @maple-review-bot to ask about one.}