fix(brand-claim): recover from stale WorkOS domain entries with null token/prefix

[bokelley]

Closes #3953

When issueDomainChallenge found an existing pending domain entry in WorkOS that had null verificationToken or verificationPrefix, it returned the stale row as ok: true. The caller then rendered "Issued a challenge for {domain} but WorkOS didn't return a DNS record to publish — that's unusual." with no user recovery path. Every retry hit the same deterministic code path. Unsticking required manual admin deletion of the WorkOS domain row in the console (escalation #302, vastlint.org). The idempotent pre-check now detects this broken state, deletes the stale row (with 404/410 tolerance for concurrent requests), and falls through to a fresh createOrganizationDomain call so a usable token and prefix are returned. Verified entries are untouched — the guard only fires when !isVerifiedState(state).

Non-breaking justification: purely server-side behavioral fix; no API contract, schema, or protocol definition changes. Changeset is --empty.

Pre-PR review:

• code-reviewer: approved — inner try/catch correctly insulates outer getOrganization catch; == null is right (SDK types token as string|undefined); changeset front-matter correct. Nits: (1) toHaveBeenCalledWith({ organizationId: ORG, domain: DOMAIN }) assertion missing in the two stale-delete tests; (2) no test for state: verified, token: null to prove the isVerifiedState guard blocks the delete path. Neither is a CI blocker.
• internal-tools-strategist: approved — programmatic delete is safe (verified rows can't satisfy the null-token guard); warn log is structured adequately for PostHog queries; follow-up: instrument a brand_claim_stale_domain_deleted PostHog event to track production frequency.

Triage-managed PR. This bot does not currently iterate on
review comments or PR conversation threads (only on the source
issue). To unblock:

• Push fixup commits directly: gh pr checkout 3953 →
  fix → push.
• Or re-trigger: comment /triage execute on the source
  issue.

See #3121
for context.

Session: https://claude.ai/code/session_01Cy3qQbLTEqJ4dd7xyXPe79

---

Generated by Claude Code

[bokelley]

Closing in favor of #3956, which addresses #3953 with a more focused patch. Both PRs target the same null-token brand-claim recovery path; #3956 is non-draft and ready to merge.