[codex] Harden workspace onboarding withdrawal recovery

[SadPossum]

What changed

• persist a Workspaces-owned deferred withdrawal fact when the Organizations withdrawal arrives before the original claim request, then consume it under the existing per-source mutation coordinator
• make withdrawal replay/conflict handling, claim correlation, terminal cleanup, retention reconciliation, tenant export/destruction, and PostgreSQL rollback fail closed
• serialize source finalization and close the restriction-recovery and concurrent-last-claim gaps without introducing the obsolete plan-row lock design
• advance the Workspaces personal-data and tenant catalog to v12, with an additive guarded migration, canonical scope constraints, indexes, dense destruction coverage, and immutable digest evidence
• fence enrollment-link profile submit/correction against exact authoritative pending claim state and decision deadline
• keep Admin API global ActiveSession identities compatible with tenant-scoped RBAC, freeze Notifications v1 history status codes, and add a Reservations exactly-once inbox regression
• pin the current Staff v19 personal-data artifacts and correct the Staff bootstrap task ledger so it does not overstate anonymized-identity replay safety

Why

Organizations withdrawal and request events use independent durable subscriptions. A withdrawal delivered first could exhaust broker retries before Workspaces learned the claim id, leaving a pending onboarding record and staged applicant data. Existing terminalization also had source-finalization races, and the fixed-global Admin authentication profile could not administer a non-default tenant under ActiveSession.

The implementation keeps product state in Workspaces, generic lifecycle authority in Organizations, identity state in Staff/Auth, and reuses the existing source coordinator instead of creating cross-module internals.

User and operator impact

A withdrawn applicant converges to a terminal redacted Workspaces state even with out-of-order or overlapping delivery. Recovery and retention can repair bound pending claims, tenant export/destruction includes the deferred fact, and malformed or contradictory authority fails closed. Admin authentication remains global while tenant RBAC remains the authorization authority.

This branch does not add a deployment, enable production withdrawal by itself, or claim end-to-end rollout completion.

Verification

Exact head 11041d4d on base b684edf4:

• final merge-tree was conflict-free with no filename overlap against the last upstream advance; all four commits are patch-identical in the final range-diff
• serialized solution build: 0 warnings, 0 errors
• Staff: 272 passed
• Workspaces: 398 passed
• Architecture: 102 passed
• non-Docker verifier: 5,169 passed, 0 failed, 0 skipped across 36 executing assemblies; 6 Docker-only assemblies correctly had no matching tests
• migration drift: 21/21 configured contexts
• affected Admin/Workspaces PostgreSQL scenarios: 12/12
• Staff PostgreSQL replay/account-link class: 2/2
• scoped dotnet format style --verify-no-changes, release, security, source-package, solution, submodule, diff, and clean-status checks passed

Staff v19 immutable evidence:

• personal-data catalog SHA-256: 2ea2548e0142b9b9dcb36fdbab663337f511dd57d49f7d86d4ce098fa400b325
• owner manifest SHA-256: 046696ce337d86aebdf4a6b2d2ab2158333559c9138a3227e700cf3ad7da549b
• inventory SHA-256: 30e3e20610d9cdc7bca48c30d2c9c38eeede0511986e88a7fae43fa16cedf95c

The default whitespace formatter still reports the repository's existing configuration contradiction: .gitattributes forces LF while the C# .editorconfig section requests CRLF. Verify mode made no edits; the scoped style verifier above is green. Hosted Ubuntu and Windows validation, Security Baseline, and Trivy checks passed on this exact pushed head.

Release blockers and rollout gates

This draft is not release-ready until all of the following are resolved and evidenced:

• Staff onboarding and owner bootstrap still lack lifecycle-durable source correlation after AuthSubject unlink/anonymisation/retention deletes detailed mutation receipts; the ambiguous legacy cohort requires explicit zero-row evidence or manual disposition, never inferred backfill
• drain old Staff/Workspaces consumers and perform a hard single-version Workspaces cutover before status 10 or deferred state can be written; mixed workers are unsafe
• drain or disposition frozen Workspaces v11 termination work, approve the v12 catalog/owner digest, and recompute the production migration target digest
• run production-shaped migration Plan/Apply/lock timing, same-link contention under the 30-second handler budget, and the legacy future-dated Staff data scan
• coordinate backend and web draft PR #23, including old-tab mutation control and deployed lost-response/withdrawal smoke
• merge and consume the generic invitation-status precondition in GMA Organizations draft PR #12 before claiming invitation-backed correction authority; the correction-target GET remains intentionally optimistic in this slice

Prefer forward repair; downgrade must stop v12 writers first and the migration refuses destructive rollback while withdrawal state exists.