feat(identity): make persons-seed CLI-only with a scheduled CronJob (#1690) (#2046)

[mozhaev-dev]

Cherry-pick of #2046 (merge fab0089) from main into release-2026.07.1 — the delivery path to the deployed instances (#1690 is a vz_blocker; dev tracks this branch).

Clean pick, no conflicts (24 files). See #2046 for the full description, review threads, and the manual-run instructions.

Verified on this base: 72 unit tests, clippy clean, helm lint green.
Verified live on dev (image from the merged main, manual Job from the CronJob): org_chart unfroze (max valid_from 27.07 → 29.07), sole-tenant inference works with dev's untouched Secret (WARN + inferred 63b4c45f…), re-runs idempotent, journal rows completed with trigger: "cli".

Rollout note: dev currently runs a manually-applied image + CronJob (drift); this PR makes the delivery durable. No config changes required anywhere — instances without tenant_default_id in their Secret work via sole-tenant inference.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 58875229-7ee8-492b-839b-a9bd00173ed6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⚠️ Regenerate the connectors-ddl snapshot

This PR changes src/ingestion/**. If your change affects any
bronze / silver / gold schema, regenerate the committed DDL snapshot
and include it in this PR.

Prerequisites (details: src/ingestion/scripts/bootstrap-db/README.md):

• docker + a fresh throwaway ClickHouse 25.7.5 (README "Local ClickHouse for testing")
• .env from .env.bootstrap.example pointing at it; use the host LAN IP,
  reachable from both the host and connector containers
  (host.docker.internal does not resolve on the macOS host itself)
• python3.12 or python3.11 on PATH (pinned dbt venv)
• HubSpot + Salesforce credentials in .env — their discover calls the
  live APIs; without them, apply ../connectors-ddl/{hubspot,salesforce}.sql
  (relative to bootstrap-db/) to seed their bronze, then run the dbt step

cd src/ingestion/scripts/bootstrap-db
set -a; source pins.env; source .env; set +a
./bootstrap-db.sh connectors-config.yaml   # fresh ClickHouse 25.7.5
./dump-ddl.sh                              # writes scripts/connectors-ddl/*.sql

Commit the resulting scripts/connectors-ddl/*.sql diff. If nothing
changed, no snapshot update is needed. (Regeneration is manual for now.)