Add retry-safe projection batch claims

[dills122]

Summary

• add deterministic projection-batch identities, durable claims, member frontiers, and cleanup guards
• establish database-clock retry authority before candidate selection in both projection topologies
• retain completed authority for the full retry horizon so staggered stale selectors cannot repeat effects
• keep claim, read-model effects, watermark advancement, and completion atomic; injected pre-watermark failures now roll everything back
• strengthen ambiguous-commit coverage so repeated lifecycle enqueues cannot hide behind dirty-table conflict coalescing
• repair the live Redpanda crash gate for Kafka transaction semantics and wire its materializer/projector fault hooks through Compose

Why

An ambiguous database commit or delayed stale selector must not repeat non-idempotent projection effects. This slice makes the claimed canonical membership the durable authority and fails closed when that authority is incomplete, expired, or conflicts with immutable projection semantics.

Verification

• ./gradlew check — passed, including JaCoCo coverage verification
• focused migrated-PostgreSQL claim/materialization integration suite — passed
• node --test scripts/dev/db/migrate.test.mjs — 25/25 passed
• make dev-smoke-venue-event-crash-gate — passed on a fresh isolated Docker stack
  • all four partitions covered
  • engine publish and transaction-offset failures recovered
  • materializer commit-before-ack failure recovered
  • projector failure left zero rows and zero watermarks before restart
  • zero replay gaps, checksum mismatches, missing outcomes, or duplicate replay inserts
• Compose configuration, script syntax, and git diff --check — passed

Scope

This completes the Slice 1A correctness foundation. It does not claim the final projection throughput target; DigitalOcean scaling gates remain the next evidence step.