feat: add noncurrent lifecycle engine

[ferhatelmas]

What kind of change does this PR introduce?

feature

What is the new behavior?

Adds shard schema, a deletion executor, and tighter lifecycle-config gates. Nothing in this process calls run(), so objects still do not expire.

• The API flag is STORAGE_VERSIONING_ENABLED, plus per-tenant objectVersioning.
• Tenant DBs get shard/journal tables and arm/commit SQL. Tests can expire supplied noncurrent versions on S3.
• PUT/DELETE run under a config deadline, restore the request abort signal, and wakeTenant in multitenant (no dispatcher consumes it).
• An armed journal blocks bucket delete.
• S3 HEAD can take a caller abort signal.

Additional context

Related to #1347

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[coveralls]

Coverage Report for CI Build 34483126498

Coverage increased (+0.2%) to 82.726%

Details

• Coverage increased (+0.2%) from the base build.
• Patch coverage: 44 uncovered changes across 3 files (476 of 520 lines covered, 91.54%).
• 19 coverage regressions across 2 files.

Uncovered Changes

File	Changed	Covered	%
src/storage/lifecycle/executor.ts	200	176	88.0%
src/storage/database/pg.ts	205	189	92.2%
src/test/utils/lifecycle-versioning.ts	45	41	91.11%
Total (14 files)	520	476	91.54%

Coverage Regressions

19 previously-covered lines in 2 files lost coverage.

File	Lines Losing Coverage	Coverage
src/internal/http/agent.ts	17	32.56%
src/http/routes/s3/index.ts	2	86.09%

---

Coverage Stats

Relevant Lines:	14466
Covered Lines:	12429
Line Coverage:	85.92%
Relevant Branches:	8783
Covered Branches:	6804
Branch Coverage:	77.47%
Branches in Coverage %:	Yes
Coverage Strength:	705.97 hits per line

---

💛 - Coveralls

[claude]

Beyond the inline finding, I also checked the unguarded pre-commit wakeTenant call in withLifecycleConfigurationTransaction (control-plane.ts) — since it runs before the transaction starts, a failure there just aborts the request with no side effects yet, unlike the post-commit call which is wrapped in try/catch because it runs after data is already committed. I also checked the new S3-backend startup validation that requires STORAGE_LIFECYCLE_CLAIM_LEASE_MS to exceed the S3 client timeout plus recovery grace when STORAGE_VERSIONING_ENABLED is on — this is an intentional safety gate against unsafe destructive-lifecycle configs on S3, not an accidental crash.

Extended reasoning...

One confirmed finding (the STORAGE_LIFECYCLE_ENABLED to STORAGE_VERSIONING_ENABLED rename with no back-compat alias) is already being posted inline, so this note only adds the ruled-out context. I re-read control-plane.ts and confirmed the pre-commit wakeTenant call is unguarded but runs before any transactional side effects occur, so a failure there is a clean abort rather than a partial-commit hazard — different in kind from the post-commit call, which is deliberately wrapped in try/catch because side effects are already committed by that point. I also read the config.ts validation block and confirmed the STORAGE_VERSIONING_ENABLED + S3 backend check is a deliberate startup guard (requiring a sane claim-lease/timeout relationship) rather than an unintended crash path.