fix(deploy): SetTTL terminal/permanent guard authoritative in SQL — close TOCTOU

[mastermanas805]

What (design-review follow-up to #228)

SetTTL guarded permanent + terminal deploys via a pre-read of the looked-up row, then called SetDeploymentTTL whose UPDATE only guarded ttl_policy != 'permanent'. The review panel surfaced:

1. TOCTOU — a deploy reaped to expired/deleted/stopped (or made permanent) between the handler's status read and the UPDATE still got expires_at re-armed + reminders_sent reset to 0, re-entering the reminder-email cycle for a deploy the user thinks is gone. A lost race returned 200 "TTL set" for a write that never happened.
2. The terminal SQL guard was missing entirely (only permanent was guarded).

Fix

Make the status-guarded UPDATE the authoritative guard:

WHERE id=$2 AND ttl_policy != 'permanent' AND status NOT IN ('deleted','expired','stopped')

SetDeploymentTTL returns whether a row was actually updated. The handler drops the stale pre-read; on !applied it re-reads (now authoritative) only to choose the precise code — already_permanent vs invalid_state — so a concurrent change yields an honest 409, never a phantom 200.

Added lifecycleTerminalStatusesSQL (deleted/expired/stopped) as a named const, deliberately distinct from terminalDeploymentStatusesSQL (deleted/expired): the former = "reject lifecycle mutations" (stopped is terminal); the latter = "hide from list" (stopped is still visible). The panel's "unify them" call was wrong — documented why they differ.

Coverage

Symptom:        TTL re-armed on a concurrently-reaped/permanent deploy; phantom 200 on lost race
Sites:          SetDeploymentTTL (model) + SetTTL handler
Coverage test:  model SetDeploymentTTL 100% (+0-rows→applied=false sqlmock case);
                existing TestSetTTL_{Permanent,Terminal}Rejected now deterministically cover the
                re-read !applied sub-branches (permanent→already_permanent, terminal→invalid_state)
Live verified:  go test vs real Postgres+Redis; all changed lines covered (count≥1)

Signature change threaded through 3 callers.

🤖 Generated with Claude Code