fix(investigations): restart only from the status it read - #2321

🟢 Confidence 10/10 · safe to merge. A two-line guard on status = existing.status, matching the documented "guard on the state it was decided from" rule, pinned by a test that fails without it.
_{no findings · tests covered · risk high}

restartInvestigation's UPDATE now also requires the status it read, so a resolve landing between the read and the write is a 409 instead of being overwritten. The added PGlite test lands exactly that write and pins the 409, the unchanged row and the unsent turn.

• restartInvestigation UPDATE guards on status = existing.status
• New test wraps Database to run a resolve between the restart's read and its update

_{eba5480 · Reply "won't fix" to dismiss a finding, or mention @maple-review-bot to ask about one.}