Delete Process Conversation

Delete a conversation that lives on ANOTHER omicos process — an SSH remote's own store, or a cloud process (sherlock / racknerd).

The SPA can only DELETE against its own local core (/api/conversations/ always resolves there), so a conversation owned by a different process had no delete path at all: the row came back on the next list. This is that path.

Three steps, in this order for a reason:

1. Check the process belongs to the caller. Explicitly, rather than leaning on _process_rpc's own check, because step 3 is allowed to fail and must not be what gates access.
2. Stamp the cloud ARCHIVE rows deleted (never remove them — see _mark_conversation_deleted). Recording the intent BEFORE acting on it is what makes the delete durable: every read path filters on the stamp, so the conversation leaves the user's view whether or not the owning process is reachable, and the tombstone guarantees the files go even if step 3 never lands. Relaying first would mean a failure here could destroy the user's files without recording that we did.
3. Relay to the owning process so it drops the real on-disk copy now rather than on its next sweep. Best-effort ON PURPOSE — offline (409), timed out (504), or a core that errored are all just "not yet" once the tombstone exists, so none of them may fail the delete. Delete means delete on the user's own machines; only the archive survives.