review: fix 26 findings from a 4-agent audit

CORRECTNESS
- lost-lease race: complete()/fail() did not check ownership, so a worker whose
  lease expired could mark a task done while another worker was running it, or
  requeue a task someone else owned. Reproduced, fixed with a CAS on
  (state, locked_by), pinned by two regression tests.
- worker died on report failure: _run_one's docstring claimed no exception
  escapes the TaskGroup; fail()/complete() were outside the guarded block, so a
  DB blip cancelled every sibling provision on the pod.
- claim query used an INNER join, which could strand a just-claimed task and
  report 'queue empty'. LEFT join.
- InstanceRepo.set_error bypassed the state machine and had no callers. Deleted.
- handle_deprovision ignored its CAS result, so a wrong-state instance kept a
  dangling endpoint and got re-provisioned by the drift check 60s later.
- handle_verify re-notified on every retry: five pages for one halt.

DEPLOY-BREAKING
- the migration Job could never succeed: no Dockerfile copied migrations/, and
  migrate.py resolved the path relative to the source tree, which only works for
  an editable install. Added COPY + SVCFORGE_MIGRATIONS_DIR.
- ServiceMonitor selector did not match the Service: API metrics never scraped.
- SvcforgeReconcilerStale fired permanently from every pod, because the gauge is
  module-level and every service exports it as 0. Scoped to the reconciler job.
- SvcforgeTaskFailed latched forever on a monotonic counter. Now increase()[15m].
- the digest guard accepted the all-zeros placeholder.
- worker terminationGracePeriodSeconds was 60s against a 600s helm timeout.

DEAD CODE THAT SHOULD NOT HAVE BEEN
- adapters/k8s.py was never called, so tenant namespaces were never created and
  the first provision for a new team would fail. Wired into handle_provision.
- adapters/redis.py was never imported by any service. Rate limiting is now wired
  into the API, failing open.
- Settings.check_production() had no callers. Given an explicit environment and
  called from every entrypoint.

OBSERVABILITY
- the API never called obs.setup(): no JSON logs, no trace correlation, log_json
  silently inert.
- LogNotifier's structured fields were discarded by the stdlib->structlog bridge.
- bind_task_context cleared the 'service' binding for the life of every task.
- split tasks_failed into task_attempts_failed and tasks_dead_lettered.

SECURITY
- trivy correctly blocked the worker/reconciler images: helm 3.16.2 and kubectl
  1.31.2 carry CRITICAL Go stdlib CVEs. Bumped to helm 3.21.3 and kubectl 1.35.3,
  which also closes a four-minor skew against the v1.35.3 cluster.

TESTS THAT COULD NOT FAIL
- the concurrency cap test passed on a fully serial worker.
- the alert/metric cross-check asserted a hardcoded list instead of reading the
  chart, so it could not catch a rename on the chart side.
- fixed OTel tracer-provider pollution between test files.

DOCS
- ARCHITECTURE.md: mermaid diagrams, user stories, and the helm-vs-ArgoCD
  guarantee (verified with --dry-run=server).
- AGENTS.md + CLAUDE.md.
- prose sweep for back-and-forth phrasing across 19 files.

tests/integration/test_tasks.py

@@ -35,7 +35,7 @@ async def test_complete_marks_done_and_releases_lock(pool: DictPool) -> None:
     tid = await repo.enqueue_standalone(iid, TaskKind.PROVISION)
     claimed = await repo.claim("w1")
     assert claimed is not None
-    await repo.complete(claimed.id)
+    await repo.complete(claimed.id, "w1")
     row = await _task_row(pool, tid)
     assert row["state"] == "done"
     assert row["locked_by"] is None
@@ -49,7 +49,7 @@ async def test_fail_under_max_attempts_requeues_with_future_run_after(pool: Dict
     assert claimed is not None
     assert claimed.attempts == 1  # attempts increments at CLAIM time, not on failure
 
-    await repo.fail(tid, "helm exploded", max_attempts=5)
+    await repo.fail(tid, "helm exploded", "w1", max_attempts=5)
     row = await _task_row(pool, tid)
     assert row["state"] == "queued"
     assert row["last_error"] == "helm exploded"
@@ -66,10 +66,12 @@ async def test_fail_at_max_attempts_dead_letters_and_marks_instance(pool: DictPo
     tasks, instances = TaskRepo(pool), InstanceRepo(pool)
     tid = await tasks.enqueue_standalone(iid, TaskKind.PROVISION)
 
+    claimed = await tasks.claim("w1")
+    assert claimed is not None
     async with pool.connection() as conn, conn.cursor() as cur:
         await cur.execute("update tasks set attempts = 5 where id = %s", (tid,))
 
-    await tasks.fail(tid, "chart not found", max_attempts=5)
+    assert await tasks.fail(tid, "chart not found", "w1", max_attempts=5) is True
 
     row = await _task_row(pool, tid)
     assert row["state"] == "failed"
@@ -90,10 +92,12 @@ async def test_fail_does_not_resurrect_a_deleted_instance(pool: DictPool) -> Non
     tasks, instances = TaskRepo(pool), InstanceRepo(pool)
     tid = await tasks.enqueue_standalone(iid, TaskKind.DEPROVISION)
 
+    claimed = await tasks.claim("w1")
+    assert claimed is not None
     async with pool.connection() as conn, conn.cursor() as cur:
         await cur.execute("update tasks set attempts = 5 where id = %s", (tid,))
 
-    await tasks.fail(tid, "helm uninstall kept failing", max_attempts=5)
+    assert await tasks.fail(tid, "helm uninstall kept failing", "w1", max_attempts=5) is True
 
     # The task still dead-letters — that part is unconditional.
     row = await _task_row(pool, tid)
@@ -111,7 +115,7 @@ async def test_fail_truncates_error_to_2kb(pool: DictPool) -> None:
     repo = TaskRepo(pool)
     tid = await repo.enqueue_standalone(iid, TaskKind.PROVISION)
     await repo.claim("w1")
-    await repo.fail(tid, "x" * 9000, max_attempts=5)
+    await repo.fail(tid, "x" * 9000, "w1", max_attempts=5)
     row = await _task_row(pool, tid)
     assert isinstance(row["last_error"], str)
     assert len(row["last_error"]) == 2000
@@ -153,3 +157,56 @@ async def test_fresh_lease_is_not_reset(pool: DictPool) -> None:
     await repo.enqueue_standalone(iid, TaskKind.PROVISION)
     await repo.claim("w1")
     assert await repo.reset_expired_leases(lease_seconds=300) == 0
+
+
+async def test_stale_worker_cannot_complete_a_task_another_worker_now_owns(pool: DictPool) -> None:
+    """The lost-lease race, as a regression test.
+
+    Worker A hangs past its lease. The reconciler requeues the task. Worker B claims it and
+    starts working. Worker A finally returns and reports success. Without the ownership
+    check in `complete`, A marks the task done while B is still running it: B's helm
+    install is unaccounted for, and if B then fails, the task is resurrected and a THIRD
+    worker provisions the same instance. That is the double-provision the claim query's
+    whole design exists to prevent, arriving through the back door.
+    """
+    iid = await make_instance(pool)
+    repo = TaskRepo(pool)
+    tid = await repo.enqueue_standalone(iid, TaskKind.PROVISION)
+
+    a = await repo.claim("worker-A")
+    assert a is not None
+
+    # A's lease expires and the reconciler hands the task back to the queue.
+    async with pool.connection() as conn, conn.cursor() as cur:
+        await cur.execute("update tasks set locked_at = now() - interval '10 minutes' where id=%s", (tid,))
+    assert await repo.reset_expired_leases(lease_seconds=300) == 1
+
+    b = await repo.claim("worker-B")
+    assert b is not None, "worker-B should have been able to claim the requeued task"
+
+    # A reports. It must lose.
+    assert await repo.complete(tid, "worker-A") is False, "stale worker completed a task it no longer owns"
+
+    row = await _task_row(pool, tid)
+    assert row["state"] == "running", "the task must still belong to worker-B"
+    assert row["locked_by"] == "worker-B"
+
+
+async def test_stale_worker_cannot_fail_a_task_another_worker_now_owns(pool: DictPool) -> None:
+    """The mirror case: a stale failure report must not requeue someone else's task."""
+    iid = await make_instance(pool)
+    repo = TaskRepo(pool)
+    tid = await repo.enqueue_standalone(iid, TaskKind.PROVISION)
+
+    assert await repo.claim("worker-A") is not None
+    async with pool.connection() as conn, conn.cursor() as cur:
+        await cur.execute("update tasks set locked_at = now() - interval '10 minutes' where id=%s", (tid,))
+    await repo.reset_expired_leases(lease_seconds=300)
+    assert await repo.claim("worker-B") is not None
+
+    assert await repo.fail(tid, "stale report", "worker-A", max_attempts=5) is False
+
+    row = await _task_row(pool, tid)
+    assert row["state"] == "running"
+    assert row["locked_by"] == "worker-B"
+    assert row["last_error"] is None, "a stale worker wrote its error onto another worker's task"