Scale Salesforce ingestion with Bulk API 2.0

[harrisonoconnorhover]

What changed

• Route the Salesforce connector through a dedicated Bulk API 2.0 QueryAll source.
• Add server-filtered SystemModstamp >= watermark SOQL for hosted replay.
• Stream CSV result pages using Salesforce result locators and bounded job polling.
• Preserve SCD1 last-record-wins publication, soft-delete visibility, cleanup, and the existing connector/auth interface.
• Document the operating boundary and update the handoff with source-free proof results.

Why

The previous synchronous QueryAll path materialized a complete Salesforce response and reread every Account on every hosted run. This change makes extraction bounded by page size and lets Salesforce filter subsequent hosted reads at the committed cursor.

Validation

• uv run ruff check .
• uv run ruff format --check .
• uv run mypy src tests
• uv run pytest — 677 passed
• dependency audit — no known vulnerabilities
• Terraform format/init/validation, including stage zero — passed
• wheel/sdist build and distribution inspection — passed
• local Linux container build and runtime-contract checks — passed

Source-free acceptance

A fresh wheel was installed outside the checkout and run from a generated project with no copied src/ tree. Against the disposable Salesforce dev org and disposable GCP project it proved initial load, tied-boundary replay, one-record server-filtered replay, and QueryAll soft-delete capture. Raw and staging remained at 14 unique Account IDs, the cursor advanced monotonically, transforms and four assertions passed, run history completed, and the lease cleared.

No retained scheduler, retained deployment, package version, tag, or public release changed. NetSuite remains simulator-validated only.