fix(derived data): Make heal_stale_derived_data stale group selection more efficient

[kcons]

Rather than querying for N group_ids in a not-that-efficient way, hit the (pipeline_hash, group_id) index directly and have Postgres only give us the ID ranges.

[sentry]

Bug: The logic to determine scan_limit can incorrectly exceed the intended maximum value _MAX_SCANNED_GROUP_IDS if chunk_size is unusually large.
_{Severity: LOW}

Suggested Fix

The clamping logic should be corrected to respect the upper bound. A safer implementation would be scan_limit = max(chunk_size * 2, min(_MAX_SCANNED_GROUP_IDS, scan_limit)).

Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.

Location: src/sentry/issues/derived/tasks_util.py#L104

Potential issue: The logic to clamp the `scan_limit` is flawed. The line `scan_limit =
max(_MAX_SCANNED_GROUP_IDS, chunk_size * 2)` is intended to ensure the scan limit is at
least two chunks, but it can incorrectly increase the `scan_limit` beyond the
`_MAX_SCANNED_GROUP_IDS` safety maximum. This occurs if `chunk_size` is configured to an
extremely large value (over 1 million), defeating the hard limit intended to protect
system resources.

_{Did we get this right? 👍 / 👎 to inform future reviews.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want reviews to match your repository better? Bugbot Learning can learn team-specific rules from PR activity. A team admin can enable Learning in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit b556924. Configure here.}