fix: prevent missing limits from overwriting existing limits

[igor-kupczynski]

Description

When one tenant resource-limit row is missing, recovery reuses overwrite-capable upsert semantics and can alter unrelated existing or custom limits.

Type of change

• Bug fix (non-breaking change which fixes an issue)
• Test changes (add, refactor, improve or change a test)

What's Changed

• Add a dedicated insert-only conflict path for missing defaults.
• Add focused Postgres regression tests and generated sqlc output.

Checklist

Changes have been:

• Tested (unit, integration, or manually with steps specified)
• Linted and formatted
• Documented (where applicable)
• Added to CHANGELOG (where applicable) -- see Keep a Changelog

Testing

• go test -count=1 -timeout 10m -v -run 'TestCanCreate_MissingIncomingWebhook_' ./pkg/repository/

---

🤖 AI Disclosure

• I acknowledge that an LLM was used in the creation of this Pull Request, in accordance with Hatchet's AI_POLICY.md.

• Details: Cursor (GPT-5.6 Sol) assisted with implementation, tests, and PR preparation; the changes were reviewed and verified with the commands above.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hatchet-docs	Ready	Preview, Comment	Jul 28, 2026 1:25pm

[github-actions]

⚠️ Optional test failure: The load-deadlock job failed on this PR (optimistic-scheduling=false). This check is non-mandatory and does not block merging, but may be worth investigating. View logs