[Epic]: Control-plane storage and write-path safety

### Summary

On **2026-08-29 ~10:05 UTC** the control plane took the whole shared Postgres cluster down — including every login across every lightbridge service — because one append-only table had no retention. The same write paths also issue one round trip per row and `MERGE` against an unconstrained key.

### Intent

Retention, batching and schema integrity are one story: they are all "the write path is safe to leave running unattended". Treating them as three unrelated tickets is how the first one reached production.

### Children

- **#637** — `webhook_deliveries` has no retention (the table that caused the outage)
- **#630** — per-row `INSERT` loop instead of a batched `QueryBuilder`
- **#631** — no uniqueness constraint behind the symbol `MERGE`

### Acceptance Criteria

1. Every append-only table in the control plane has a retention policy and a recurring sweep, proven to hold an **absolute size ceiling** stated in the ticket.
2. `pg_total_relation_size` is recorded before and after the reclaim, in the PR.
3. Bulk inserts use a single batched statement; a test asserts round-trip count does not scale with row count.
4. The symbol `MERGE` has a real uniqueness constraint behind it.

### Out of Scope

- The shared-cluster topology itself (`ai-helm` ADR-0135 splits auth off bulk data).

### Technical Context

⚠️ **#637's "existing 4.2 GB" is already stale** — measured 2026-08-29 on a table the ticket itself shows accelerating (13,338 → 28,111 rows/day, ~150 MB/day), so its "~122 days runway" framing expires around 2026-12-29. AC 1–2 above replace the moving number with a ceiling.

### AI Usage Declaration

Drafted by Claude Opus 5 during the 2026-09-01 triage sweep. AI output is not truth; the owner verifies.