feat(dataflow): durable activation evidence for exactly-once admission

[wolfy-j]

Adds durable activation evidence so an automation that starts a workflow run can never lose that run's terminal outcome before acknowledging it. This is part of the Kickside automation-engine redesign (workflows as a writable destination with exactly-once delivery).

• ensure_activation(dataflow_id, admission_key): idempotent. Repeating the same key never increments the generation. A different key for the same dataflow returns a typed CONFLICT.
• get_activation_evidence: returns the terminal status, outcome and generation, which are recorded when the workflow reaches a terminal state.
• ack_terminal(dataflow_id, admission_key, generation): compare-and-set acknowledgement. It is idempotent; a mismatched key or generation returns CONFLICT, and missing evidence returns UNAVAILABLE.
• DELETE_WORKFLOW: refuses with CONFLICT while a keyed activation has unacknowledged evidence. It cascades normally after the acknowledgement. Unkeyed legacy rows keep today's behavior.
• Locking: every mutation locks the parent dataflows row first (FOR UPDATE on PostgreSQL, a writer-lock no-op update on SQLite). No nested pool acquisition happens inside a transaction.
• Migration 10_admission_evidence: identical constraints on PostgreSQL and SQLite, including partial indexes, and a backfill of ever_activated.
• Errors: all new errors are typed.
• File sizes: client.lua and activation_repo.lua are split into cohesive modules, client/admission.lua and persist/activation/*.

Tests: native make test-* passes on SQLite (1,032) and PostgreSQL (993). Lint's one warning is pre-existing (func_child_output_test fixpoint). Two independent reviews passed.