fix(gateway): preserve expiration sweep coverage

[Menci]

Summary

D1 reports meta.changes from SQLite total_changes(), which includes writes performed by trigger programs. Dump and spilled Responses deletion therefore returned a trigger-amplified count rather than the number of source rows deleted. Inactive cleanup could mistake a full batch for a drained key and remove its expiration_sweeps row while records remained.

• Count dump, Responses item, and snapshot deletions from DELETE ... RETURNING result rows.
• Add migration 0082_expiration_sweep_integrity.sql.
• Reject deletion of a sweep row while its dump or Responses domain still contains rows.
• Make the sweep domain and key identity immutable so coverage cannot be reassigned.
• Re-enqueue existing dump and Responses keys that are missing queue coverage without changing existing due times, revisions, or claims.
• Keep the one-time legacy backfill for descriptor registration; no recurring full-table reconciliation is added.

The migration installs the deletion guard before repairing coverage, so the pre-deploy Worker cannot recreate the gap during a migrate-then-deploy rollout.

Test Plan

• Trigger-amplified D1 change-count regressions for dump and spilled Responses deletion.
• Migration repair preserves existing queue state and excludes empty keys.
• Dump and Responses queue deletion is rejected until the final domain row is gone, and queue identity updates are rejected.
• Repaired deleted and retention-disabled dump keys drain in bounded ticks.
• Actual Node instance: migration repairs a missing queue; scheduled ticks drain 75 → 25 with the queue retained, then 25 → 0.
• Actual workerd/local D1 instance: old code reproduces meta.changes = 150 for 50 dump rows and loses the queue; current code repairs and drains 70 → 20 → 0.
• pnpm run verify — 544 test files and 5,654 tests passed, plus lint, typecheck, installer harness, generated assets, AGENTS validation, verification parity, and web build.