review: fix 26 findings from a 4-agent audit

CORRECTNESS
- lost-lease race: complete()/fail() did not check ownership, so a worker whose
  lease expired could mark a task done while another worker was running it, or
  requeue a task someone else owned. Reproduced, fixed with a CAS on
  (state, locked_by), pinned by two regression tests.
- worker died on report failure: _run_one's docstring claimed no exception
  escapes the TaskGroup; fail()/complete() were outside the guarded block, so a
  DB blip cancelled every sibling provision on the pod.
- claim query used an INNER join, which could strand a just-claimed task and
  report 'queue empty'. LEFT join.
- InstanceRepo.set_error bypassed the state machine and had no callers. Deleted.
- handle_deprovision ignored its CAS result, so a wrong-state instance kept a
  dangling endpoint and got re-provisioned by the drift check 60s later.
- handle_verify re-notified on every retry: five pages for one halt.

DEPLOY-BREAKING
- the migration Job could never succeed: no Dockerfile copied migrations/, and
  migrate.py resolved the path relative to the source tree, which only works for
  an editable install. Added COPY + SVCFORGE_MIGRATIONS_DIR.
- ServiceMonitor selector did not match the Service: API metrics never scraped.
- SvcforgeReconcilerStale fired permanently from every pod, because the gauge is
  module-level and every service exports it as 0. Scoped to the reconciler job.
- SvcforgeTaskFailed latched forever on a monotonic counter. Now increase()[15m].
- the digest guard accepted the all-zeros placeholder.
- worker terminationGracePeriodSeconds was 60s against a 600s helm timeout.

DEAD CODE THAT SHOULD NOT HAVE BEEN
- adapters/k8s.py was never called, so tenant namespaces were never created and
  the first provision for a new team would fail. Wired into handle_provision.
- adapters/redis.py was never imported by any service. Rate limiting is now wired
  into the API, failing open.
- Settings.check_production() had no callers. Given an explicit environment and
  called from every entrypoint.

OBSERVABILITY
- the API never called obs.setup(): no JSON logs, no trace correlation, log_json
  silently inert.
- LogNotifier's structured fields were discarded by the stdlib->structlog bridge.
- bind_task_context cleared the 'service' binding for the life of every task.
- split tasks_failed into task_attempts_failed and tasks_dead_lettered.

SECURITY
- trivy correctly blocked the worker/reconciler images: helm 3.16.2 and kubectl
  1.31.2 carry CRITICAL Go stdlib CVEs. Bumped to helm 3.21.3 and kubectl 1.35.3,
  which also closes a four-minor skew against the v1.35.3 cluster.

TESTS THAT COULD NOT FAIL
- the concurrency cap test passed on a fully serial worker.
- the alert/metric cross-check asserted a hardcoded list instead of reading the
  chart, so it could not catch a rename on the chart side.
- fixed OTel tracer-provider pollution between test files.

DOCS
- ARCHITECTURE.md: mermaid diagrams, user stories, and the helm-vs-ArgoCD
  guarantee (verified with --dry-run=server).
- AGENTS.md + CLAUDE.md.
- prose sweep for back-and-forth phrasing across 19 files.

tests/integration/test_reconciler.py

@@ -267,8 +267,8 @@ async def test_lease_expiry_returns_a_dead_workers_task_to_the_queue(pool: DictP
 async def test_lease_expiry_leaves_a_live_worker_alone(pool: DictPool) -> None:
     """A task claimed a second ago is not a dead worker. Reclaiming it would double-provision.
 
-    Handlers are idempotent, so a wrongly-freed lease is survivable — but survivable is not
-    free, and this is why lease_seconds sits above helm's own --timeout.
+    Handlers are idempotent, so a wrongly-freed lease is survivable, though it still costs a
+    duplicated helm run — which is why lease_seconds sits above helm's own --timeout.
     """
     instance_id, _, _ = await _seed(pool)
     tasks = TaskRepo(pool)
@@ -419,8 +419,9 @@ async def test_version_drift_parks_the_upgrade_until_the_maintenance_window(
 ) -> None:
     """The queue does the waiting, in `where run_after <= now()`.
 
-    Not a scheduler and not an in-memory timer: a task parked in Postgres until 03:00 Sunday
-    survives a reconciler restart. That is the whole reason `run_after` exists.
+    The waiting is done by the queue rather than by a scheduler or an in-memory timer: a
+    task parked in Postgres until 03:00 Sunday survives a reconciler restart. That is the
+    whole reason `run_after` exists.
     """
     instance_id, _, _ = await _seed(pool, maintenance_window=SUNDAY_0300_HCM)
 
@@ -520,8 +521,19 @@ def tracing() -> InMemorySpanExporter:
 
     Global because OTEL's is: `trace.set_tracer_provider` takes once per process, and
     `obs.tracer()` resolves it at call time. Session-scoped so the second call never
-    happens.
+    happens from HERE.
+
+    The internals reset is load-bearing rather than cosmetic. `set_tracer_provider` is
+    one-shot: a second call logs "Overriding of current TracerProvider is not allowed" at
+    WARNING and is otherwise ignored. Any earlier test that builds a FastAPI app calls
+    `obs.setup()` and burns that one shot, after which this fixture silently installs
+    nothing, `get_finished_spans()` returns `[]`, and the failure reads as "the reconciler
+    stopped writing traceparents" rather than "another test got there first". Clearing the
+    module globals is the only way to take the shot back.
     """
+    trace._TRACER_PROVIDER = None
+    trace._TRACER_PROVIDER_SET_ONCE._done = False
+
     exporter = InMemorySpanExporter()
     provider = TracerProvider()
     provider.add_span_processor(SimpleSpanProcessor(exporter))