fix(persist): order terminal lifecycle locks

[wolfy-j]

Summary

• establish the workflow row as the first lock for transactions that cross into activation or wake state
• acquire that lifecycle lock before terminal workflow updates, avoiding PostgreSQL lock upgrades from FOR NO KEY UPDATE to FOR UPDATE
• preserve existing not-found and terminal cleanup behavior

Root cause

A terminal update first took PostgreSQL's weaker row lock through UPDATE dataflows, then disable_terminal_tx requested FOR UPDATE. A concurrent child commit could hold a foreign-key KEY SHARE lock on the workflow row while waiting to update it, producing the inverse wait and a deadlock.

Verification

• Dataflow SQLite suite: 718/718
• Dataflow PostgreSQL suite: 681/681
• Dataflow SQLite restart proof: passed
• Dataflow PostgreSQL restart proof: passed
• Research native-Cycle acceptance: 26/26 on SQLite and 26/26 on PostgreSQL
• Research exact-process hard-restart proof: repeated pass on SQLite and PostgreSQL, with one recovered Dataflow, one terminal result, one Evidence row/link, and zero PostgreSQL deadlocks

The full lint command still reports six unrelated pre-existing findings on clean v0.7.0; this change adds none.