fix(p0-3): emit provision.persistence_failed audit + agent_action + coverage tests

[mastermanas805]

Summary

MR-P0-3 (BugBash 2026-05-20) atomic-provisioning hardening — completion of the orphan-resource prevention work shipped in commit 36eac9b.

That commit wired all 18 provisioning callsites through finalizeProvision, which on persistence failure tears down the backend object (best-effort), soft-deletes the row, and returns errProvisionPersistFailed so handlers map to 503 instead of 201. This PR closes three remaining gaps:

1. Operator-visible audit row: emit AuditKindProvisionPersistenceFailed (provision.persistence_failed) on every persistence-failure path. Mirrors AuditKindBillingChargeUndeliverable and AuditKindPropagationDeadLettered — internal operator alert, not customer-email.

2. agent_action for provision_failed: the catch-all 503 envelope used to fall back to AgentActionContactSupport. That's wrong for the MR-P0-3 path — the backend object was rolled back, so the right action is 'retry with exponential backoff', not 'email support'. New codeToAgentAction entry follows the U3 contract.

3. Registry-iterating coverage tests (CLAUDE.md rule 18): two static guards in provision_atomicity_coverage_test.go scan every production .go file in internal/handlers/ and assert:

   • every file calling models.CreateResource also calls finalizeProvision
   • every file calling finalizeProvision also routes the error through respondProvisionFailed or twinCoreErr
   • TestProvisionFailedHasAgentAction asserts the catch-all code carries explicit guidance (no fallback)

Per-handler audit findings

• db.go: already atomic (finalizeProvision at L265, L432, L642)
• cache.go: already atomic (L232, L387, L564)
• nosql.go: already atomic (L228, L380, L569)
• queue.go: already atomic (L306, L525)
• storage.go: already atomic (L335, L525)
• webhook.go: already atomic (L327, L444 — cleanup=nil OK, no backend object)
• vector.go: already atomic (L370, L522)
• deploy.go: DIFFERENT MODEL — async 202; row persisted before async build runs; failures update status. Not P0-3 shape.
• stack.go: DIFFERENT MODEL — async 202; same shape as deploy.

Coverage block (CLAUDE.md rule 17)

Symptom:        201 returned for resource the platform can't address
                (orphan backend + NULL conn_url + NULL PRID + billed)
Enumeration:    rg -l 'models.CreateResource\(' internal/handlers/
                yielded db.go, cache.go, nosql.go, queue.go, storage.go,
                webhook.go, vector.go (each w/ anon + auth + twin paths)
Sites found:    7 files × ~3 paths = ~21 provisioning entry points
Sites touched:  none added — every site already calls finalizeProvision
                per commit 36eac9b. This PR adds a coverage TEST that
                fails the build if a new site bypasses the pattern.
Coverage test:  TestEveryCreateResourceCallSiteIsFollowedByFinalizeProvision
                + TestEveryFinalizeProvisionCallSiteRespondsProvisionFailedOnError
                + TestProvisionFailedHasAgentAction
Live verified:  pending CI green + master Deploy

Test output

=== RUN   TestEveryCreateResourceCallSiteIsFollowedByFinalizeProvision
--- PASS: TestEveryCreateResourceCallSiteIsFollowedByFinalizeProvision (0.73s)
=== RUN   TestEveryFinalizeProvisionCallSiteRespondsProvisionFailedOnError
--- PASS: TestEveryFinalizeProvisionCallSiteRespondsProvisionFailedOnError (0.70s)
=== RUN   TestProvisionFailedHasAgentAction
--- PASS: TestProvisionFailedHasAgentAction (0.00s)

=== RUN   TestFinalizeProvision_PersistenceFailure_ReturnsErrorAndRunsCleanup
INFO audit.event audit_kind=provision.persistence_failed actor=system resource_type=postgres
--- PASS: TestFinalizeProvision_PersistenceFailure_ReturnsErrorAndRunsCleanup (0.10s)
=== RUN   TestFinalizeProvision_Success_FlipsToActive
--- PASS: TestFinalizeProvision_Success_FlipsToActive (0.08s)

Two pre-existing tests (TestRespondError_UnknownCode_5xx_FallsBackToContactSupport, TestErrorEnvelope_503_AllFieldsAndHeader) used provision_failed as their 'unregistered 5xx code' fixture; swapped to db_error (per helpers.go curation principles).

Six other failures (TestDBNew_*, TestBulkTwin_*) are pre-existing on master — they require port-forward to customer-postgres at localhost:5434; not caused by this PR (verified by checkout master and reproducing).

🤖 Generated with Claude Code