Add expiration, deletion, and storage reclamation for provisioned sites

[chubes4]

Parent: #1970

Goal

Give the elastic preview fleet a safe, observable lifecycle so site identities and storage can be expired, deleted, retained, or reclaimed without cross-generation data exposure.

Scope

• site TTL and retention policy at allocation time
• explicit owner-authorized deletion and optional renewal
• two-phase active -> deleting -> tombstoned lifecycle
• mutation fence and operation cancellation before teardown
• generation-bound identities preventing stale host, credential, queue, or cache reuse
• bounded reclamation of canonical MDI objects, publications, uploads, mutable wp-content, staged artifacts, operation records, and claims
• immutable deletion receipts and retryable garbage-collection checkpoints
• quota release only after the lifecycle reaches its declared safe state

Acceptance criteria

• Expiration blocks new mutations and claims while preserving the configured read/grace policy.
• Deletion cannot race an import, canonical commit, publication promotion, or administrator claim.
• Retried cleanup converges after Worker eviction or partial R2 deletion.
• Reusing a human slug or hostname creates a new generation that cannot read old cookies, credentials, caches, operations, or objects.
• Cross-site and cross-generation deletion attempts fail without mutation.
• Receipts report retained and removed object counts/bytes plus unresolved work.
• Local gates cover active operations, stale queue delivery, publication reads during grace, final tombstone, and allocation quota recovery.
• No production deletion or deployment is performed by this issue.

AI assistance

OpenAI GPT-5.6 Sol via OpenCode identified the missing fleet lifecycle boundary and drafted this reclamation contract with Chris Huber.

[chubes4]

Implementation is complete and verified on feat/2081-site-lifecycle at 34b63250. PR finalization is waiting for prerequisite PR #2108 to merge.

Implemented:

• owner-authorized lifecycle status, renewal, and deletion API
• TTL plus read/grace retention, active -> deleting -> tombstoned state
• generation and operation fencing across operation creation, queue claims, renewals, prepared/terminal transitions, publication callbacks, administrator claims, imports, Worker mutation routes, and final publication promotion
• cancellation of queued/in-flight work when teardown begins
• bounded retryable R2 and D1 reclamation with checkpoints
• immutable receipts with removed/retained/unresolved object, byte, and record accounting
• quota release only after terminal tombstone
• anonymous immutable publication reads remain R2-only during grace

Evidence:

• Initial durable Cook: agent-task-09a72a6c-9b9a-4184-9a40-b9eb17475339
• Corrective Cook: agent-task-5d14f14d-dd10-40c5-ab50-b091aa04cbb2
• Fencing/reclamation Cook: agent-task-3c8fd1e0-47b4-472e-9daf-bb27b8baf458
• npm run build passed
• npm run test:cloudflare-runtime passed, including in-flight deletion, stale claim/publication, grace, partial cleanup, administrator claim, tombstone receipt, and quota recovery coverage
• npm run cloudflare:dry-run:d1 passed
• git diff --check passed

No production deletion or deployment was performed.

AI assistance: OpenCode with OpenAI GPT-5.6 Sol and GPT-5.6 Terra was used to implement, review, correct, and verify the lifecycle changes.