test(db): pin owner-deletion mediator replay and manual handoff semantics #7949

Follow-up from #7818 historical review at 1f1b5f4. Nonblocking coverage/documentation work; no behavior change requested.

Architecture disposition: mediating_operator_pubkey is immutable provenance of the initial admission, not part of the owner intent idempotency key. A second authenticated allowlisted operator may replay the same UUID/host/owner/acknowledgement version and receive the original request; replay does not rewrite the original mediator or assert a new consent ceremony. Document this explicitly and add a two-operator replay regression that checks original provenance remains unchanged. Do not add operator identity to the replay comparison absent a separately justified contract change.

Add a separate store regression for manual submit handoff: an existing submitted owner request converges when submit requested_by is the owner pubkey; using the operator pubkey conflicts. Check identity/stage and no unintended second request or provenance mutation. Drive actual store entry points.

Run full affected package/PostgreSQL suite on remote compute and attribute results to the tested SHA. These cases were requested for coverage, not demonstrated failing behavior. Preserve #7818 current head while its CI and live verification finish.