Block deleted bundle reads from cache

[digzrow-coder]

Summary

• Rebase the deleted app-scoped attachment guard onto current main.
• Block cache/R2 reads when a requested path matches a soft-deleted bundle, a persisted manifest asset, or a deleted manifest-path tombstone.
• Persist manifest-path tombstones before deleting public.manifest rows so stale cached delta/asset reads stay blocked after manifest cleanup.
• Keep private download links from resolving deleted bundles.
• Add indexes/table support for deleted bundle and manifest-path lookups.
• Add regression coverage for deleted bundle paths, persisted manifest paths, tombstoned manifest paths, local proxy reads, delete cleanup, and non-deleted cached bundle reads.

Supersedes Cap-go#2124 because the original PR branch is owned by a fork I cannot push to from this account.

/claim Cap-go#1667

Test plan

• bun x vitest run tests/files-app-read-guard.unit.test.ts tests/files-local-read-proxy.unit.test.ts tests/download-link-deleted-bundle.unit.test.ts tests/on-version-update-cleanup.unit.test.ts -> 4 files / 13 tests passed
• bun x eslint supabase/functions/_backend/files/files.ts supabase/functions/_backend/triggers/on_version_update.ts supabase/functions/_backend/private/download_link.ts tests/download-link-deleted-bundle.unit.test.ts tests/files-app-read-guard.unit.test.ts tests/files-local-read-proxy.unit.test.ts tests/on-version-update-cleanup.unit.test.ts
• git diff --check

Screenshots

Not applicable; backend-only change.

Checklist

• My code follows the code style of this project and passes the targeted lint checks listed above.
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• My change has adequate E2E test coverage.
• I have tested my code manually, and I have provided steps how to reproduce my tests.