fix(gmail): harden OAuth watch ownership lifecycle

[bsbds]

Stack 2/5. Depends on xorbitsai/xagent#1588. Merge after the owner-aware OAuth foundation and before actor-owned credential creation in PR #78.

Summary

• move every Gmail OAuth lookup, trigger binding, scan, provisioning, callback, release, and reconciliation path to the ordinary owner namespace
• reject actor-owned credentials during Gmail service construction and watch provisioning
• enforce exact Gmail trigger, watch, OAuth-account, provider, and user ownership
• preserve Gmail history cursors when ownership validation fails
• retain local watch tracking when a remote Gmail watch cannot be stopped safely
• expose ownership mismatches through durable failure state, warning logs, and degradation signals
• capture account identity before transition locking to avoid post-commit ORM reloads while the advisory-lock connection is held
• detect orphan, cross-user, non-Gmail, and nonordinary watch rows during rollout

Scope

This PR contains the complete Gmail ownership boundary and lifecycle hardening, including the Gmail-specific ordinary-consumer tests and rollout checks. The owner-aware schema, query helpers, non-Gmail scoping, and SQLite migration recovery remain in PR xorbitsai#1588.

Verification

• focused Gmail, ordinary-consumer, OAuth ownership, and migration suites passed: 179 passed and 4 PostgreSQL-only tests skipped locally
• full pre-commit suite passed
• all previously reviewed Gmail code and test files remain byte-identical to the prior combined Gmail head 033c47432b920aeac86b5c7d3a8140361ed062d2
• the only changes relative to that prior combined head are the inherited foundation migration repair, its tests and documentation, and merged main updates
• no migration or schema implementation is introduced by this PR-local diff

Rollout

Land this PR before enabling any downstream writer that creates actor-owned OAuth credentials. PR #78 remains based on this branch so actor-owned rows cannot coexist with owner-blind Gmail behavior.