test(jobs): drive deploy-lifecycle workers to 95.8% coverage

Adds deploy_lifecycle_coverage_test.go covering the deploy-lifecycle
worker surface: status reconcile (autopsy per-tick cap/defer, k8s
clientset constructor error path), failure autopsy (pod-log success +
error branches, current-terminated Error reason, oversize-event
truncation, scanner partial-read), notify webhook (cursor read/write
failures, empty batch, transient-DNS hold, SSRF-reject + no-webhook
cursor-advance errors, delivery-failed audit-insert error, fetchBatch
rows.Err, real pinned dial), deployment expirer (rows.Err, async audit
DB error), and deployment reminder (full sweep with CAS skip + hours
floor, scan error, rows.Err, CAS RowsAffected error).

Per-file statement coverage now: expirer/reminder/orphan_canceler 100%,
status_reconcile 95.2%, notify_webhook 93.0%, autopsy 91.4%,
orphan_reconciler 97.7% — 95.8% across the seven target files.
Remaining gaps are production k8s-clientset wrappers and defensive
json.Marshal-of-primitive paths that require a live cluster.

Test-only change. `make gate` (build + vet + go test ./... -short) green.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: mastermanas805