fix(channels): retain final-delivery jobs after Queue send failure

[AsperforMias]

Closes #303.

Summary

• Persist a durable final-delivery ledger row before attempting Queue dispatch.
• Retain the row when Queue send() rejects or reports an ambiguous failure after acceptance.
• Redrive retained rows from the Worker scheduled handler.

Why

A final response could be lost when D1 insert succeeded but Queue dispatch failed: the previous path deleted the only durable delivery record.

Verification

• Commands: just test-file apps/api/tests/channel-final-delivery-scheduling.test.ts (15 pass); just tc-package @mosoo/api.
• Manual steps: injected both an ambiguous Queue result (message accepted, then send() throws) and a rejected Queue send. The real final-delivery ledger, Worker scheduled handler, queue consumer, and in-memory D1 path retained the job, redrove it, delivered it, and ACKed it.
• Not run: just check was not run; no real Cloudflare production account or remote Queue/D1 was used.

Impact

• User/API/contract changes: None.
• Generated files / GraphQL / DB / lockfile: None.
• Env or config changes: None.
• Risk and rollback: The scheduled redrive scans a bounded set of retained jobs. Revert this PR to stop new redrives; retained ledger rows remain available for controlled recovery.

Review

• Closest review areas: channel final-delivery ledger, Worker scheduled handling, queue idempotency.
• Known trade-offs: Cloudflare platform behavior was not tested against a real account. The local verification uses the real D1/Worker/service chain with Queue behavior injected only at the Cloudflare binding boundary.

[Yevanchen]

Reviewed the durable outbox/redrive flow and did not find a code-level blocker in this pass. This still should not merge now: Channels is deliberately unavailable as an end-to-end product surface (no reachable setup UI or provider live-account smoke), and #303 is deferred rather than fixed.

Keep this draft; when Channels is revived, rebase onto current main and rerun the current repository plus live-boundary verification.