fix(workflow): close scheduler and projection gaps

[clearmud]

What changed

• make workflow definition ingest atomic: the signed kind-30620 source event and executable registry projection now commit or roll back together
• give cron scans a two-tick overlapping lookback and select the latest due instant
• add rollback, ownership/channel confinement, tick-overrun, and overlapping-window regressions

Root cause

The cron loop sleeps for 60 seconds and previously looked back exactly 60 seconds using an exclusive lower bound. Database and workflow work between sleeps could move the next scan just past that window, permanently missing a scheduled instant.

Workflow definition ingest also committed the registry row separately from the signed kind-30620 event consumed by Desktop. A commit failure could therefore leave a runnable workflow that was invisible in the Workflows UI.

Impact

Scheduled workflows tolerate normal tick drift without duplicate execution because existing durable (community_id, workflow_id, scheduled_for) claims deduplicate the overlapping scan window. Workflow registry and Desktop projection state can no longer diverge at ingest.

Validation

• cargo fmt --all -- --check
• cargo test -p buzz-workflow — 155 passed, 0 failed, 2 ignored
• cargo test -p buzz-db --lib — 94 passed, 0 failed, 155 ignored
• cargo clippy -p buzz-workflow -p buzz-db -p buzz-relay --all-targets -- -D warnings
• cargo test -p buzz-relay --lib — 830 passed, 9 failed, 38 ignored; the 9 existing failures require a configured local Postgres service (PoolTimedOut) and do not touch the workflow paths