Vetting Delivery Tick

PR #524 round 6: deliver ready vetting reports, send the 48h follow-ups, and run the two retention purges (third-party media 90 days after delivery; work a requester discarded, 90 days after the discard).

External cron (.github/workflows/grading-retry-cron.yml, hourly), never the in-process scheduler alone: interval jobs starve on Railway replicas (the enrollment stall, 2026-08-18). The lifecycle tick keeps calling the same code as a fallback; both take one advisory lock and every step is idempotent (conditional-UPDATE claims, purges match only rows that still hold content), so a double call delivers, follows up and purges nothing twice. Delivery is gated on VETTING_ENABLED; the purges run whatever the flag says.