fix(kiloclaw): log destroy and auto-top-up cleanup

[jeanduplessis]

Summary

Adds changelog coverage for destroy cleanup and credit-renewal auto-top-up marker updates.

Why this change is needed

Destroy flows were clearing subscription lifecycle fields without recording the mutation in the subscription audit log. Credit renewal also marked auto_top_up_triggered_for_period without a matching changelog entry. That left two subscription mutation paths outside required audit coverage even though the underlying rows were being changed.

How this is addressed

• Added shared web helper for post-destroy subscription lifecycle cleanup that clears surviving subscription lifecycle fields and writes status_changed / instance_destroyed in one transaction.
• Updated both personal and organization KiloClaw destroy flows to use that logged cleanup path.
• Logged credit-renewal auto-top-up marker writes in the billing worker using the existing lifecycle changelog helper with explicit renewal-marker reason.
• Added targeted router and worker tests for personal destroy cleanup, organization destroy cleanup, and auto-top-up marker logging.

Verification

• pnpm test -- apps/web/src/routers/kiloclaw-router.test.ts apps/web/src/routers/organizations/organization-kiloclaw-router.test.ts
• pnpm --filter kiloclaw-billing test -- src/lifecycle.test.ts
• pnpm typecheck
• pnpm format

Visual Changes

N/A

Reviewer Notes

Human Reviewer

• Stacked on docs(specs): clarify kiloclaw compliance rules #2578.
• clearSubscriptionLifecycleAfterInstanceDestroy intentionally preserves subscription row and only clears destroy-related lifecycle fields on surviving billing state. Reviewers should confirm this matches intended destroyed-instance successor model.
• Auto-top-up marker changelog uses status_changed / credit_renewal_auto_top_up_marked instead of introducing a new action label. That keeps vocabulary stable but treats marker writes as lifecycle state changes rather than separate top-up events.

Code Reviewer Agent

Code Reviewer Notes

• Main web change is shared helper in apps/web/src/lib/kiloclaw/instance-lifecycle.ts, reused by both personal and org destroy routers.
• Helper writes changelog only when destroy cleanup actually clears destruction_deadline or clears suspended_at on non-past_due rows; past_due rows still keep suspension state.
• Billing worker change is local to processPersonalCreditRenewalRow in services/kiloclaw-billing/src/lifecycle.ts: fetch before, update auto_top_up_triggered_for_period, then log via existing insertLifecycleChangeLogBestEffort helper.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (2 files)

• services/kiloclaw-billing/src/lifecycle.ts
• services/kiloclaw-billing/src/lifecycle.test.ts

---

_{Reviewed by gpt-5.4-20260305 · 900,136 tokens}