refactor: wave b structural hardening

[iamjr15]

Wave B of the approved architecture-hardening plan (rev 5.3). Three commits, each adversarially reviewed (two DIVERGENT verdicts fully remediated before commit, one SOUND).

• B1/B2: ~2.9k LOC of worker policy evicted from packages/db to its owners with every invariant still enforced inside its original locked transaction; db→billing dependency inverted. Includes a systemic fix: the dependency-cruiser gate was blind to ALL resolved cross-package edges (dist-exclude); now visible (1,218→1,656 edges) with both ban rules proven firing.
• B3/B4/B5: one route manifest kills the 3× path declarations (all 21 forwarded routes, costs verified 1:1); create-run runs one handle + two short transactions with no pg transaction held across DO RPCs, thread read deduplicated, deleted-thread race returns typed 404; compile-time-branded UserContextDatabase; types ./api + ./internal subpaths (root barrel −117 lines, web provably cannot reach internal contracts). Ultra/Max tiers fully pruned (types, env, billing catalog, worker branches) — fixes the half-configured checkout bug; tier CHECK narrowed via appended migration 0001.
• B6: analytics watchdog deleted (+its 2 CF env keys); OpsMaintenanceWorkflow split into per-job workflows with precise envs; daily maintenance is tableless — one deterministic instance per UTC day, immutable payload cutoff, idempotent R2 delete + identity-rechecked DB delete (timestamp(3) identity + disjoint-run-state proofs reviewed), accepted next-day recovery; daily_maintenance_jobs dropped via appended migration 0002; byok-revalidation demoted to cron+lease (per-target failure isolation + loud error events added per review).

Operator note post-merge: the old cheatcode-ops-maintenance Workflow resource is orphaned in the Cloudflare account by the rename — delete it manually.

Gates per commit: biome, tsc, turbo build --force, knip zero, dependency-cruiser clean, drizzle ledger append-only.