Rationalise the sync CronJobs (dot-project-sync, maintainer-sanitize, github-profile-sync)

## Classification
Task (decision + operational cleanup)

## Current state (`deploy/manifests/`)

| CronJob | Schedule | State |
| --- | --- | --- |
| `github-profile-sync` | daily | active |
| `maintainer-sanitize` | every 5 min | suspended |
| `dot-project-sync` | hourly | suspended (runs are manual via the staff UI) |

## Problems this exposed

- Nothing archives maintainers while `maintainer-sanitize` is suspended.
- `github-profile-sync` writes maintainers with raw GORM, bypassing the
Store and its audit trail.
- `dot-project-sync` and the web-bff enrichment run share code but differ in
wiring (a per-project enricher vs. one global enrich-all pass; two LFX
resolution paths). A stale lfx observation can permanently exempt a
maintainer from re-enrichment.

## Ask

Decide the end-state set of jobs, their cadences, overlap locks, and which
ones survive the ongoing `.project`-file migration; un-suspend deliberately
rather than by archaeology.

## Relationships

- `github-profile-sync` bypassing the Store relates to the Store-interface
refactor issue (per-domain interfaces would make this bypass visible/
preventable).
- The "two LFX resolution paths" problem is the same duplication tracked in
#124.
- Sibling to a not-yet-filed "retire the legacy maintainer ref files" design
draft, which owns deciding `maintainer-sanitize`'s ultimate fate.
- `dot-project-sync`'s suspension is entangled with #147 (403 from a
classic-PAT github token) and #156 (replace with a CNCF-owned GitHub App) —
this issue is about the job topology/cadence decision, those are about its
auth.
- The general "stale observation blocks re-enrichment" failure mode was
fixed for per-profile staleness by #158 (closed); the job-level "skip a
maintainer entirely if any lfx row exists" gating referenced above is a
distinct, still-open instance of the same class of bug.

Start by reviewing the CronJob definitions under deploy/manifests/ and the current schedules and suspension states listed in the issue. Compare the shared dot-project-sync and web-bff enrichment wiring, then use #124, #147, #156, #158, and #167's migration relationships to define the surviving jobs, cadences, locks, and intentional suspension state. Done means the end-state topology is decided and documented without duplicating the auth or LFX work owned elsewhere.

Written by the indexing model from the issue text.