Segment membership Edge backfill

[khvn26]

Scope

• process_segment_canonical_changed branches on env type. For edge envs:
  • Iterate via existing EdgeIdentity wrappers (paginated DDB scan).
  • Identity.objects.bulk_create(ignore_conflicts=True) per batch matched on (environment_id, identifier).
  • Build engine EvaluationContext from each DDB record's traits.
  • Accumulate bitmaps in memory; write AtomBitmap rows after the scan.
• EnvironmentMembershipMetadata.last_backfill_completed_at updated on success.

Acceptance criteria

• Backfill of a synthetic edge env (mocked DDB) produces bitmaps that match is_context_in_segment for every DDB identity over the operator vocabulary.
• A backfill that fails partway leaves last_backfill_status="failed" and the prior bitmap data intact.
• The new core Identity rows are minimal (identifier + env + first-seen) — no trait persistence.