fix(queue): make scale-set reconciliation reachable

[rldyourmnd]

Outcome

Makes the authoritative scale-set cleanup/rehydration path introduced in .47 reachable. The existing entity query intentionally filters workflow_job_id > 0, so every scale-set row (workflow_job_id=0) bypassed reconciliation.

A dedicated SQL query now returns only scale-set protocol rows for the exact entity and status. Ordinary webhook consumers keep their old query and cannot duplicate scale-set work. GARM v0.2.1-nddev.48 appends both bounded sets, sorts oldest-first and applies the existing authoritative logic.

Live evidence

• .47 remained healthy but did not remove four known cancelled rows or rehydrate eight valid untrusted rows after multiple 30-second cycles
• SQL source proved the hard workflow_job_id > 0 exclusion

Verification

• SQL regression proves webhook query returns only webhook row and scale-set query only scale-set row
• targeted offline race tests: database/sql, runner/pool, workers/scaleset, workers/provider
• two reproducible GARM .48 builds: d0b7f57714756fe1283d815dc0ec9b624993c92aae1537a4b4638ae2e2c83ed3
• make verify and gitleaks