Segment membership backfill lifecycle #7407

Scope

• EnvironmentMembershipMetadata model: last_backfill_started_at, last_backfill_completed_at, last_backfill_status.
• Maintenance tasks populate the metadata at task start and again at task completion / failure.
• Atomic bitmap swap on backfill completion: a refresh of an env that already has bitmap data leaves the prior data readable until the new bitmaps replace it in a single transaction.
• Enqueue guard: refuse to enqueue a new backfill for an env if last_backfill_status="running", or if last_backfill_started_at is within a configurable cooldown window (default 1 minute).

Acceptance criteria

• A first-ever backfill leaves last_backfill_status="running" while the task runs and succeeded when it completes.
• A refresh of an env with existing bitmap data sets status back to running without clearing the prior data; the prior bitmaps remain queryable until the new ones replace them atomically.
• Failed backfills leave status="failed" and emit a segment_membership.backfill.failed structlog event.
• Enqueueing a backfill for an env whose last_backfill_status="running" is a no-op: no duplicate task, no metadata mutation, sentinel returned.
• Enqueueing a backfill within the cooldown window of a previous completion is a no-op until the window passes.