feat(orchestrator): harden zero-impact shadow rollout

Gate and bound Portal shadow observations while preserving Native execution. Add fail-closed service boundaries, terminal retention controls, Canary readiness telemetry, ops visibility, and isolated regression coverage.

services/orchestrator/executor-job-store.mjs

@@ -192,6 +192,41 @@ export function createPostgresExecutorJobStore({
       return projectRow(result.rows?.[0]);
     },
 
+    async deleteById(jobId) {
+      const result = await pool.query(
+        `DELETE FROM ${table}
+          WHERE job_id = $1
+          RETURNING job_id`,
+        [String(jobId ?? '').trim()],
+      );
+      return Boolean(result.rows?.[0]);
+    },
+
+    async listTerminalBefore({ before, limit = 100 } = {}) {
+      const cutoff = Number(before);
+      if (!Number.isFinite(cutoff)) return [];
+      const pageSize = Math.min(500, Math.max(1, Number(limit) || 100));
+      const result = await pool.query(
+        `SELECT
+           state_json->>'jobId' AS job_id,
+           state_json->>'workflowRunId' AS workflow_run_id,
+           (state_json->>'completedAt')::BIGINT AS completed_at
+         FROM ${table}
+         WHERE state_json->>'status' = ANY($1::text[])
+           AND state_json->>'workflowRunId' IS NOT NULL
+           AND COALESCE((state_json->>'completedAt')::BIGINT, 0) > 0
+           AND (state_json->>'completedAt')::BIGINT <= $2
+         ORDER BY (state_json->>'completedAt')::BIGINT ASC, job_id ASC
+         LIMIT $3`,
+        [['succeeded', 'failed', 'cancelled', 'timed_out', 'blocked'], cutoff, pageSize],
+      );
+      return (result.rows ?? []).map((row) => ({
+        jobId: row.job_id,
+        workflowRunId: row.workflow_run_id,
+        completedAt: Number(row.completed_at),
+      }));
+    },
+
     async createIfAbsent(record, { initialEvent = null } = {}) {
       const created = await withTransaction(pool, async (client) => {
         const inserted = await client.query(