fix(store): persist periodic SQLite cleanup and retry failed deletes

[DeliciousBuding]

Summary

The SQLite periodic cleanup loop calls the in-memory Store.CleanupRuns directly and never commits the resulting deletes. On source base 49078e7adce93c8ed61108c6f427782f475cfc2c, a real timer tick removes an expired run and its evidence from memory, but all six durable rows remain. Reopening without the final Close/Flush persist restores the run and checkpoint. This is a deterministic local SQLite reproduction, not a production load or process-kill claim.

The prior historical tracker #2154 mentioned cleanup-loop shutdown, but its text incorrectly treated s.store.CleanupRuns as a persistence call. This issue uses the current code and a real durable-reopen failure instead of reopening that catch-all tracker.

Scope / file ownership

One writer in an isolated task worktree. Allowed files:

• edge-server/internal/store/sqlite_store.go: commit periodic deletions, retain pending persistence for retry after transient failure, and stop/join owned background loops before final shutdown persistence. Tests use testing/synctest to advance the actual constructor-owned loops at production cadence; no shortened interval seam is added.
• edge-server/internal/store/sqlite_periodic_cleanup_test.go: real database, actual timer/constructor, fault-recovery and shutdown coverage.
• docs/architecture/02-edge-server.md: align the stable persistence/lifecycle description if needed.

Interfaces / invariants / exclusions

Public APIs, 5-minute cadence, 24-hour terminal TTL, 50-per-thread cap, selected terminal states and cascade membership stay unchanged. Preserve the existing explicit-write failure policy: memory may change on a failed durable commit and LastPersistError reports that failure. No schema, connection-pool, PRAGMA, WAL policy, settings, runtime configuration or deployment changes. No new verifier or broad storage abstraction; no actual workspace files are deleted by run retention.

Acceptance

• Reproduce periodic memory/disk divergence and reopen restoration on the unchanged production base.
• Actual periodic cleanup durably deletes the run and associated evidence before final close; unrelated queued data remains.
• A recoverable SQL delete failure is observable and the next timer cycle can commit pending deletes without a new business write.
• Owned background tasks finish before final close persistence and database closure; shutdown can flush pending cleanup without requiring another tick.
• Complete store/API Windows and Linux race tests, vet/staticcheck and existing document validation.
• PR required checks pass for the final head.
• Merge, source-only owner-document synchronization and cleanup of the completed task branch/worktree.

Initial failing regression: go test ./internal/store -run TestSQLitePeriodicCleanupIsDurableBeforeClose -count=1 -v from edge-server with CGO_ENABLED=0 on Windows. The test explicitly bypasses final persistence so shutdown cannot hide the missing periodic write.

[DeliciousBuding]

Verified closeout

Merged by #2344 as 81e02d403a48fdb5130c233ed2da9b8919d2a3fb. Tested PR head df01b0e1cc8eefba209e6125af2205407233cd66 and squash merge have the identical tree f47cb63e14f9bcca33a2da128042e543227717f4.

• Real SQLite regressions cover durable cleanup before final close, retry after a trigger-injected DELETE failure without any new business write, close flushing pending cleanup and close waiting for owned background work. The production constructor/cadence is driven by testing/synctest virtual time, not wall-clock performance measurement.
• Three temporary negative controls failed on behavior (not compilation): disabling persistence left six durable rows/reappearing run+checkpoint; dropping retry state left the failed transaction pending; removing shutdown join closed the database before owned work finished. All source mutations were restored byte-for-byte before final verification.
• Complete store/API tests passed on Windows and Linux race with Go 1.26.5; vet, staticcheck, existing document/contract checks and diff checks passed. CI run 34034111396 succeeded and all seven required checks were individually verified. CodeRabbit reported Review skipped, not approval.
• Stable architecture documentation and source-only operational owner notes are synchronized. The local main checkout is fast-forwarded and clean; the merged task branch/worktree and remote task branch are gone. Unrelated work and original red/green evidence remain intact.

No runtime deployment/restart/configuration change, public API/schema/retention-policy change or real workspace-file deletion. No production-load, actual process-kill, live-login or packaged Desktop claim. #2304 and #1663 remain separate open follow-ups.