fix(relay): tombstone workflow definition events on NIP-09 a-tag deletion

[mbradaschia]

Summary

NIP-09 a-tag deletion of a workflow (kind:5 with a = 30620:<pubkey>:<uuid>) removed the execution-side workflows row but left the kind:30620 definition event live in the event store: the workflow branch of handle_a_tag_deletion deliberately skipped the events-row soft-delete that the generic NIP-33 branch performs for every other addressable kind (that generic branch was itself the fix for the same bug on kind:30023 in #714 — workflows were the one kind left out). Since buzz workflows list/get and Buzz Desktop replay kind:30620 events over REQ, deleted workflows kept appearing.

Changes:

• The 30620 branch now tombstones the definition event via soft_delete_by_coordinate after its bespoke workflows-row deletion, with the same created_at scoping as the generic branch. Name-based a-tags tombstone the coordinate resolved from the workflow's UUID, since definition events carry the UUID as their d-tag.
• Secondary fix (also from the issue): delete_workflow_for_owner returns Ok(None) when no row matched instead of Err(NotFound), so a repeat delete is an idempotent no-op rather than a failed side effect logging ERROR Side effect failed: … not found.

Related issue

Fixes #6986

Testing

• New e2e regression test test_workflow_a_tag_deletion_tombstones_definition (mirrors test_long_form_a_tag_deletion from relay: NIP-09 a-tag deletion is a no-op for kind:30023 (and all non-workflow addressables) #714): create def → visible via REQ → kind:5 a-tag delete → REQ returns nothing → repeat delete (distinct created_at, so it isn't dedup-masked) stays accepted and the def stays gone. Red before the fix (got 1 events), green after.
• Relay logs during the test confirm both new paths: first delete hits soft-deleted workflow definition event, repeat delete hits both idempotent no-op branches, zero ERROR lines.
• Full e2e_relay (46 passed) + e2e_long_form (8 passed, generic-branch behavior unchanged) against a locally built relay; buzz-relay/buzz-db unit suites. Two failures are pre-existing in my environment — mesh_demo::demo_join_forwarded_arm_round_trips_echo and test_unarchive_emits_member_added_notification fail identically on unmodified main (verified by stash → rebuild → rerun).
• Live CLI repro of the exact issue flow against the fixed relay: workflows list → [] and workflows get → null after delete; repeat workflows delete exits 0.
• cargo fmt + cargo clippy --all-targets clean on touched crates.

🤖 Generated with Claude Code

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is 86b9142a09f2af3ba2fff7effa6a6cd53b40f51c...3d5e433825e67eee2183b25bafcffbe828c2f6fc.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review 3d5e433825e67eee2183b25bafcffbe828c2f6fc to authorize a new review.
Any previous review applies only to its recorded range.