Add reconciler repair backstop for df/duroxide drift

[tjgreen42]

Summary

Repair/backstop half split out from #258.

• Adds admin-only df.reconcile(grace_seconds) to delete orphaned duroxide root subtrees and fail stale df.instances rows with no runtime instance or queued start.
• Starts one built-in reconciler durable loop as df_reconciler on pg_durable.reconciler_cron; empty cron disables it.
• Adds E2E coverage for orphan subtree GC and healthy-instance safety.
• Fixes status_details schema probing across DROP/CREATE extension epochs.
• Hardens upgrade tests to isolate provider schemas, poll result visibility, and disable the auto-reconciler during schema snapshot comparisons.
• Removes the rate-limited GitHub API dependency from HTTP E2E coverage.

Stack

1. Add reconciler repair backstop for df/duroxide drift #279 - repair/backstop
2. Prevent df/duroxide drift with transactional enqueue #258 - prevention via transactional enqueue

Validation

• cargo fmt -p pg_durable -- --check
• cargo clippy --no-default-features --features pg17,http-allow-test-domains -- -D warnings
• ./scripts/test-e2e-local.sh 26_reconcile_orphan_gc --clean --default-build-phases --pg-version 17 --verbose
• ./scripts/test-e2e-local.sh 06_http_and_ssrf --clean --default-build-phases --pg-version 17 --verbose
• ./scripts/test-upgrade.sh --pg-version 17

[tjgreen42]

Closing as superseded. The repair goals are met by a simpler mechanism: #282 fail-fasts df.start() so no stuck df row is ever created (nothing to repair in that direction), and #283 adds a background reaper that deletes orphaned engine instances through duroxide's Rust API — avoiding the df.reconcile() SQL function, cron loop, and new df_reconciler role this PR introduced. The HTTP E2E de-flake from this PR is salvaged in #284.