fix(purchase): convert remaining post-CAS full-row saves to status-guarded saves #835

Problem

After #829 (single claim to running for every executor), several post-CAS saves outside the executors still use unconditional full-row upserts (SavePurchaseExecution) built from an in-memory snapshot, so a concurrent status change (cancel, reap, approve) between the CAS and the save can be overwritten. Found by the gate on #830 (resume path, fixed there) and listed as plan item T3 in #829's plan.

Proposed fix

Enumerate remaining callers of SavePurchaseExecution/SavePurchaseExecutionTx that follow a status CAS (grep), and convert each to SaveExecutionIfStatus(+Tx) with the expected status list, or a narrow conditional UPDATE of just the field being written. Real-PG17 test per converted site replaying a concurrent cancel.

Also

A failed audit stamp after the claim still lets the purchase run (cannot happen today; decide fail-closed vs best-effort).