Story-2959: expand agent-run delivery truth safely

Why this is an expand step

An agent-key CHECK is a complete allowlist, not an append-only entry. If two epics each replace it from an older snapshot, the second migration silently deletes the first epic's keys. Both migrations remain valid SQL, while live run inserts begin failing.

This step therefore writes the union: the five existing keys, AGT-013's context_judge, and the artifact seats record_registrar and indigo. Approval requests receive the same union. Chat sessions remain on the existing five because ambient artifact work is not a chat.

Deliberately temporary tolerance. run_origin is nullable, and a run may omit user_id when it is system-originated or is the existing Vega frame rail. Story-2960 owns the backfill, NOT NULL conversion, and removal of the Vega exception. This Story does none of that contraction.

Two axes, one valid product

Run status does not gain a fictional pending state. Artifact pendency lives on delivery_status while the run remains running. Existing non-delivery rows retain all ten live statuses, including aborted_cost and circuit_open.

Delivery state	Allowed run state	Required evidence
`awaiting_artifact`	`running`	Expected key and non-NULL deadline; no completion or artifact digest.
`delivered`	`succeeded` or `failed`	Completion time, lowercase SHA-256, non-negative size; a failed run also carries an error.
`swept`	`failed`	Completion time and error; no artifact digest or size.

awaiting_artifact + deadline_at = NULL
  → rejected by agent_run_awaiting_artifact_has_deadline

why: NULL < now() is UNKNOWN
  → without the CHECK, the sweeper never selects the row
  → the user-visible run can remain non-terminal forever

Database-owned safety

CHECKs make invalid state/evidence combinations unrepresentable. A partial deadline index serves the future sweeper. A transition trigger makes successful and terminal-delivery rows absorbing. The receipt table collapses repeated (run_id, sha256) deliveries. Forced firm RLS permits a firm-scoped worker with no user context while denying cross-firm runs and receipts.

Proof

A current-head PostgreSQL test inserts every key from both epics and confirms ambient keys remain absent from chat.
All ten existing statuses remain valid when delivery is not in use; every legal delivery state has a real row.
Illegal state/evidence products and terminal rewrites fail named database constraints or the transition guard.
The NULL-deadline fixture was first observed inserting successfully, then failed after the named CHECK was added.
A system worker with no user context writes within its firm; cross-firm run and receipt writes are rejected.

Recall

Step 1 only widens and makes bad delivery states impossible; Step 2 backfills and contracts after the other epic settles.