fix(engine): isolate operation completion from best-effort side-effects

[nicoloboschi]

Summary

Follow-up to #2608 that fixes the root cause of #2601 in the engine, rather than only backstopping the symptom in the poller.

execute_task marks an operation completed via _mark_operation_completed (most task types) or _mark_operation_completed_and_fire_webhook (consolidation). Both wrapped the status = 'completed' commit in one transaction with fallible side-effects — the webhook outbox insert and parent aggregation — and then swallowed every exception. So any hiccup in those side-effects rolled the completion back with them and dropped the error, leaving the operation stuck in processing forever while the log already said the work was done.

#2608 added a poller-side completion backstop that unsticks the row after the executor returns, but it fires no webhook — so on that path the consolidation webhook was silently lost, and the engine's own completion UPDATE had no status guard, so the two completion writers could both run parent aggregation.

Changes

• Idempotency guard — every completion UPDATE in the engine is now guarded on status = 'processing' (matching fix(worker): complete successful operations #2608's poller). Whichever writer runs second sees a non-processing row, updates nothing, and does not re-run parent aggregation.
• Graceful fallback instead of swallow — if the atomic outbox transaction fails, the completion is no longer lost with it. We commit the terminal state on its own, then deliver the consolidation webhook best-effort via the existing non-transactional _fire_consolidation_webhook. The happy path keeps the full transactional-outbox at-least-once guarantee; the failure path degrades to "completed + delivered" instead of "stuck + lost". The best-effort fire only runs when the fallback actually transitioned the row, so there is no duplicate delivery.

Testing

• New tests/test_operation_completion.py — fast, DB-free unit tests (fake asyncpg-style connections, same style as fix(worker): complete successful operations #2608's test_worker.py):
  • happy path uses the outbox and does not double-fire the best-effort webhook
  • webhook-outbox failure falls back to a completion commit and best-effort delivery (regression for __mark_completed() is never called after successful task execution #2601)
  • already-terminal row is a clean no-op (idempotency with the poller backstop)
• uv run pytest tests/test_operation_completion.py — 3 passed
• uv run ruff check / ruff format --check / ty check — clean on changed files

Fixes #2601.