[deploy] Add Kafka tiered storage and erasure checks
Enable stock Kafka 4.4.0/Aiven 1.2.0 tiered storage on the existing Kafka broker, preserving its data directory, cluster/topic generations, offsets and archive routes. Broker and worker share the existing backend contracts and cluster-derived prefix. The canonical deployment reconciler enables remote storage on all six existing topics.
Extend the existing account-erasure retention hook with complete native deletion history, object/multipart enumeration, local/cache removal checks, final generation checks and both retained-root holds. Deployment verifies pinned plugin checksums, required mounts, region and actual consumed broker/worker backend equality. No plugin fork, fallback mode or new tracking service is introduced. The explicitly accepted late unknown-outcome PUT/indefinite-orphan residual remains documented.
All required checks passed in CI run 42675662257, including Mutation Testing. Earlier missing/abandoned jobs coincided with the GitHub Actions and Checks API outage; a passing run does not establish a source-code repair for GitHub's scheduler. Branch protection remains active with no bypass actors. Local validation passed 23,939 unit/mobile tests, full lint, spelling, root/server/web typechecks and actionlint. Native qualification records preserved identities/offsets, remote reads after eviction/restart, canonical six-topic policy convergence and current-workspace retention rejection/recovery checks, with explicit attribution limits.
Source merge does not authorize production activation. Deploy Web remains manually disabled. Stock index-cache cleanup remains an activation blocker: covered disk indexes survived terminal remote deletion, and the guard correctly rejected them. Clearing only the stopped synthetic fixture's cache proved its positive branch, not automatic cleanup. The phase-2 packet also requires exact merged-image qualification, fresh production identity/backend/credential checks, measured capacity, quiescence, forward recovery and retained-data retirement.