Summary

• make Buzz workflow recovery durable across leases, restarts, delays, and event handoffs
• make send_message event publication and action receipt atomic
• prevent stale finalization, approval bypass, recursive workflow output, and lost outbox retries
• add deterministic crash-window and PostgreSQL integration coverage
• fix clippy -D warnings findings and document intentional wide persistence boundaries

Migration numbering (please read before reviewing the renames)

Rebased onto current main. main had since added 0025_relay_invites.sql, and this
branch had also claimed 0025, so the three migrations here were renumbered:

File contents are byte-identical across the rename — only the version prefix changed.

Worth flagging because the collision is not caught by the build: cargo check -p buzz-db
compiles cleanly with two 0025 files present. sqlx::migrate! accepts duplicate versions,
and _sqlx_migrations keys on version as its primary key, so the failure would have surfaced
at migration time rather than in CI.

It also made migration::tests non-deterministic: that suite sorts by version alone, so
assert_eq!(migrations[24].version, 25) could resolve to either file. After renumbering,
every version is unique and the index is stable.

The two conflicted assertions resolved to 28 (main's 25 + the 3 added here) — neither
side of the conflict was correct on its own.

Validation

Re-run in full after the rebase, against main @ 90e058e:

• cargo fmt --all -- --check — clean
• cargo clippy -p buzz-db -p buzz-workflow --all-targets -- -D warnings — 0 warnings
• OPENSSL_LIB_DIR=/usr/lib/x86_64-linux-gnu OPENSSL_INCLUDE_DIR=/usr/include OPENSSL_DIR=/usr cargo clippy -p buzz-relay --all-targets -- -D warnings — 0 warnings
• cargo test -p buzz-workflow --lib — 158 passed
• cargo test -p buzz-db workflow::tests --no-fail-fast -- --ignored — 14 passed against PostgreSQL 16
• cargo test -p buzz-db migration:: (incl. --ignored) — 10 passed, covering the renumbered
  migration path on a fresh database

Note for anyone reproducing locally: the --ignored migration::tests each
DROP/CREATE SCHEMA public, so under plain cargo test they race in a shared process and
fail with duplicate key ... nspname=public. CI's cargo nextest isolates each test in its
own process; locally, --test-threads=1 reproduces CI's result.

Beads: bz-k2o