fix(automation): enforce durable alert closure

Restore D037 durable incident readback without weakening database failure semantics.

Fence Agent99 dispatch and terminal learning to canonical identities, durable leases, verifier receipts, and reconciler-owned checkpoints.

Drain backup and restore legacy receipts in bounded cohorts with strict transport, claim, projection, and no-false-green controls.

Keep SSH service refusal visible while separating it from broker network-policy reachability.

apps/api/migrations/agent99_dispatch_next_attempt_at_2026-07-11.sql

@@ -0,0 +1,14 @@
+-- Durable retry not-before for Agent99 controlled dispatch claims.
+-- Prevents the 15-second reconciler tick from consuming every attempt and
+-- generation while a Redis flight lease or transport cooldown is active.
+
+BEGIN;
+
+ALTER TABLE awooop_run_state
+    ADD COLUMN IF NOT EXISTS next_attempt_at TIMESTAMP NULL;
+
+CREATE INDEX IF NOT EXISTS idx_run_state_retry_due
+    ON awooop_run_state (project_id, next_attempt_at)
+    WHERE state = 'pending' AND next_attempt_at IS NOT NULL;
+
+COMMIT;

apps/api/migrations/agent99_dispatch_next_attempt_at_2026-07-11_down.sql

@@ -0,0 +1,6 @@
+BEGIN;
+
+DROP INDEX IF EXISTS idx_run_state_retry_due;
+ALTER TABLE awooop_run_state DROP COLUMN IF EXISTS next_attempt_at;
+
+COMMIT;