fix: ship cleanup deadline recovery in Server 2.4.38

[rmcdaniel]

Change

Adopt the published Workflow 2.3.3 package in Server 2.4.38 and Helm chart
0.1.134. The lockfile changes only Workflow. Generated source release consumers
are synchronized with the repository's release tool.

Workflow 2.3.3 makes the repair pass close an expired cooperative cleanup even
when no compatible workflow worker remains and a workflow task is ready or
leased. Closure uses the canonical cancellation path, preserves the original
request deadline, and fences outstanding work. Repeating repair is idempotent.

Evidence and qualification

• Native fix: fix: enforce cleanup deadlines without a workflow worker workflow#604
• Full exact merged-source database/Laravel matrix passed:
  https://github.com/durable-workflow/workflow/actions/runs/36917693247
• Fresh published registry and Laravel upgrades passed:
  https://github.com/durable-workflow/workflow/actions/runs/36919191410
• Separate fresh published Composer install passed 15 repair tests with 117
  assertions, including foreign runs without a compatible worker. Retained
  package identity, lockfile, JUnit and commands:
  https://github.com/durable-workflow/workflow/releases/download/2.3.3/native-2.3.3-published-deadline-evidence.tar.gz
• Local source release synchronization check passed.
• Required before merge: exact PR quality, feature and release identity checks.
• Required after publication: verify both image architectures and package
  reference, exercise real deadline recovery from the published image, and run
  published PHP/Python/Rust lifecycle conformance against its exact digest.

Delivery scope

Stable worker protocol remains 1.19. The proposed cooperative service protocol
and its stronger cancellation model remain in Server PR 291 and Native PR 603.
Shared issue 136 requires a published mixed-language cascade with successful
cleanup after SIGKILL within one original 30 second budget before closure.

Native's library release does not update existing pinned Server deployments.
This PR owns the Server image and deployment example update. Cloud
qualification and any deployment decision belong to the private Cloud record.

[rmcdaniel]

Reviewed exact head 974998f. The dependency lock changes only Workflow 2.3.2 to published 2.3.3 at 70d4fe48efd7dd796c35c1078b3d5ac43f738f4f. Remaining changes are generated Server 2.4.38 / chart 0.1.134 consumers. All exact-head checks passed, including PHPUnit feature, MySQL HTTP replay/query, MySQL/Postgres rolling upgrade, kind chart install and bounded-growth smoke. Stable protocol remains 1.19. Merging this reviewed patch, then publishing and verifying the exact images and affected published lifecycle consumers.

[rmcdaniel]

Published and verified Server 2.4.38 with Workflow 2.3.3 and Helm chart 0.1.134.

• Merged source: 7ea89349b7d39c075e742dcf2e14c1ddb0d1050e.
• Exact image: durableworkflow/server@sha256:a5d70037749ef55ba8fd4cec2d7dd2ca0363ae61e6a888cde72a6afb7fdb2efd.
• Both Linux amd64 and arm64 manifests are published. The producer passed bare first-run readiness, source-free Compose bootstrap, protocol catalog convergence and anonymous chart pull/install. Producer and protected-main chart checks passed.
• Published-artifact lifecycle passed all 12 cells, including PHP 2.1.6, Python 2.3.7 and Rust 2.1.3. The tuple also includes CLI 2.1.3 and Waterline 2.0.9. No local product source was used as pass evidence.
• A separate real-wall-clock probe inside the exact published image verified expired cooperative requests with a Ready task and a genuinely Leased task, with no compatible workflow worker. Both became Cancelled, preserved original request/deadline, fenced open tasks and recorded one terminal event. Repeated repair enforced zero extra deadlines. Duplicate requests before and after closure returned their original identity.

Retained probe, commands, raw histories, labels, architecture manifests and package provenance, SHA256 46f1f23fecbc51573f42bc523164898d3652b2a886718fe9f536af99a47768f3.

This completes the released deadline-repair patch and its affected published-consumer check. The stronger cancellation model and the required mixed-language 30-second recovery cascade remain open in shared issue 136. This patch makes no Cloud deployment or cascade-completion claim. The merged remote branch has been deleted.