feat(lifecycle): integrate durable artifact cleanup worker

[seonghobae]

Objective

Implement issue #263 Slice C as a clean stacked Draft on receipt-ledger parent #277. This branch connects authorized deletion to the durable receipt state machine, exact-digest cleanup, restart recovery, bounded scheduled retries, and low-cardinality operational evidence. It does not add the Slice D HTTP status or accessible deletion UI.

Exact stack

Exact current head is 1bd5a147f847142037c824059f0c8a26a33213f0 on base branch feat/durable-deletion-receipt-ledger exact head 8448fdd98d4a6c58f4e5407fcfcce903785abaa8.

Relative to that base, it is 14 commits ahead, 0 behind, and changes 14 files:

• cleanup design and execution plan;
• ArtifactDeletionCoordinator and deterministic tests;
• low-cardinality cleanup metrics;
• Spring startup/scheduled recovery activation;
• DefaultDocumentConversionService deletion integration and durability tests;
• cleanup configuration, changelog, ADR, dependency manifest, and stacked-workflow contract.

Current contract

• create a durable immutable receipt before metadata tombstoning;
• bind cleanup to tenant, permanently reserved job identifier, and exact artifact SHA-256;
• reject artifact-generation mismatch before deletion;
• retain controlled read/delete/checksum failures for retry;
• replay incomplete receipts at application readiness and on a bounded fixed-delay schedule;
• isolate one receipt failure from later receipts in the batch;
• preserve standalone construction with an in-memory reference ledger;
• expose only aggregate completed, failed, and pending cleanup evidence.

Known acceptance blocker

This branch currently introduces spring-boot-starter-actuator solely for Micrometer registration. The parent buyer evidence requires every dependency change to regenerate the committed CycloneDX SBOM, attribution, hashes, license result, and exact-head acceptance evidence. Those artifacts are not present in this slice, so the dependency change is not accepted yet. The implementation must either remove that dependency while retaining observable aggregate evidence or regenerate the complete dependency evidence before merge.

Current evidence

Predecessor exact head 211560a2da35d2ada01146d2c3e13e1a8e221a77 passed all three fuzz jobs in run 31097875241; that result does not automatically pass this exact head. Formal exact-current-head CodeRabbit/OpenCode/Noema/Strix review, CI, Security Scan, SAST, complete Maven/JaCoCo/Javadoc evidence, SBOM/attribution evidence, zero unresolved actionable threads, and counted independent write-authorized approval remain required.

Keep this PR Draft. #270 must integrate before #268, #268 before #277, and #277 before this Slice C. Do not resolve #268's incomplete-cleanup finding or claim deletion completion until this exact branch and later link-revocation/API semantics satisfy every protection.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 45a0762f-72af-497a-84a2-87cbe9585757

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

This PR was automatically marked merged only because its mutable base branch advanced to contain the same head, leaving a 0-commit/0-file diff. It did not integrate into protected main and is not release or merge evidence. The authoritative replacements are #280 (immutable receipt foundation) and #279 (one-commit dependency-free cleanup worker).