refactor: collapse 9-path cleanup pyramid once agent is authoritative

[vybe]

Summary

CleanupService currently runs 9 distinct reconciliation paths writing to schedule_executions.status:

1. Phase 0 — reconciliation against agent /api/running
2. Phase 1 — stale >120min → FAILED
3. Phase 1b — no-session >60s → FAILED
4. Phase 1c — orphan-skipped → finalize
5. Phase 3 — slot reclaim with re-verify (patch for FAILED→SUCCESS race)
6. Slot TTL (timeout + 5min buffer)
7. Backlog 24h expiry
8. TES httpx timeout → terminate + FAILED
9. Activity stale >120min → FAILED

Each exists because the layer below can't be trusted. schedule_executions.status has 12 writers; the FAILED→SUCCESS race is possible and currently mitigated by Phase 3 just-in-time re-verify.

Target

One periodic reconciliation: DB.running ⟷ agent./api/running (agent wins). Capacity is recomputed from DB, not TTL'd. Single writer per status transition.

Depends on

• feat: Redis Streams event bus for reliable WebSocket delivery (RELIABILITY-003) #306 — agent must push completion via Redis Streams so the event consumer owns the terminal status transition.
• CAPACITY-CONSOLIDATE — cleaner to retire slot/backlog TTL logic once all three are in one class.

Gating condition — DO NOT SHIP EARLY

#306 must be in production for ≥2 weeks with zero observed orphan recoveries before this lands. The watchdog pyramid is load-bearing right now; ripping it out before push-based completion has soaked would trade known bugs for unknown ones.

Scope

1. Delete Phase 1 / 1b / 1c / 3 reconciliation from cleanup_service.py.
2. Simplify slot TTL logic — capacity becomes "count DB rows in running state," no expiry.
3. Reduce schedule_executions.status writers to ~4 (create, start, finish, external-cancel).
4. Update architecture.md cleanup section.
5. Write a migration guide for ops — what signals were previously "phase X recovered N" and where they live now.

Success criteria

• Grep for mark_stale_*, mark_no_session_*, finalize_orphaned_*, fail_stale_slot_* returns zero hits.
• Single writer per status transition, verifiable by audit query.
• Phase 0 reconciliation still exists but is the only reconciliation loop.

Context

See docs/planning/ORCHESTRATION_RELIABILITY_2026-04.md — Tier 2.5 Simplification.

[vybe]

This is the cleanup payoff of the pull migration (#1081): once execution state has a single owner, the ~9-path pyramid collapses into one lease-reaper sweep (re-queue any claimed/running row past lease_expires_at). Sequence the deletions in Phase 5, each as its own reversible PR, gated on the ≥2-week zero-orphan soak.

[vybe]

Dependency correction + status. Surfaced by the execution-bug meta-analysis (PR #1087 · docs/planning/ORCHESTRATION_BUG_META_ANALYSIS_2026-06.md).

This issue's body names its prerequisite as #306, but #306 shipped only the WebSocket/Redis-Streams transport. The real gate for collapsing the 9-path cleanup pyramid is agent push-completion = #307 — and #307's seam is currently defined-but-unwired: record_failure("missed_heartbeat") exists in dispatch_breaker.py:264 with zero consumers (verified). Until that integration lands and soaks, the watchdog is load-bearing and #429 cannot ship ("DO NOT SHIP EARLY").

Action: corrected dep to blocked-by #307; removing status-ready since this is blocked, not ready.