Add reconciler repair backstop for df/duroxide drift

[tjgreen42]

Summary

Repair/backstop half split out from #258.

• Adds admin-only df.reconcile(grace_seconds) to delete orphaned duroxide root subtrees and fail stale df.instances rows with no runtime instance or queued start.
• Starts one built-in reconciler durable loop as df_reconciler on pg_durable.reconciler_cron; empty cron disables it.
• Adds E2E coverage for orphan subtree GC and healthy-instance safety.
• Fixes status_details schema probing across DROP/CREATE extension epochs.
• Hardens upgrade tests to isolate provider schemas and poll result visibility.
• Removes the rate-limited GitHub API dependency from HTTP E2E coverage.

Stack

1. Add reconciler repair backstop for df/duroxide drift #279 - repair/backstop
2. Prevent df/duroxide drift with transactional enqueue #258 - prevention via transactional enqueue

Validation

• cargo fmt -p pg_durable -- --check
• cargo clippy --no-default-features --features pg17,http-allow-test-domains -- -D warnings
• ./scripts/test-e2e-local.sh 26_reconcile_orphan_gc --clean --default-build-phases --pg-version 17 --verbose
• ./scripts/test-e2e-local.sh 06_http_and_ssrf --clean --default-build-phases --pg-version 17 --verbose
• ./scripts/test-upgrade.sh --pg-version 17
• CI green on this PR