Implement D1 R2 and Queues adapters with fault tests

[yhay81]

Outcome

Implement the Cloudflare storage and queue substrate against the same contracts used by AWS.

Scope

• D1 atomic message, idempotency, recipients, events, and outbox operations
• R2 payload integrity, size, retention, and orphan cleanup
• Queues producer/consumer, deterministic jobs, retries, and DLQ recovery
• local fault injection for every durable write and external call

Acceptance criteria

• shared lifecycle, lease, duplicate, ordering, and failure cases pass
• D1 rollback, R2 orphan, Queue duplication, and DLQ recovery are evidenced
• limits fail before durable commit
• private data remains inside the customer account and outside default telemetry

Depends on the Workers runtime skeleton.
Parent direction: #81
Execution plan: #84

[yhay81]

Completion evidence

Implemented and merged through protected main in #116.

• reviewed head: a7391e8c7441e5325b7ec7cd575e26eacdc12d5f
• merged main: 28d5be11026cd5f89238d742044b430b030c5e6c
• no approval or admin bypass was used; strict up-to-date test and conversation resolution were preserved

Acceptance evidence

• Shared MemoryStore/D1+R2 contract covers atomic replay, single-owner leases, owner-checked acknowledgement, lifecycle ordering and duplicates, concurrent convergence, sticky suppression, failure release, and private-data exclusion.
• Current workerd integration suite passes 23/23 cases, including every staged D1 commit boundary plus batch rollback, pre-mutation recipient/payload/Queue limits, R2 checksum and immutable attachment retry, unique-key R2 orphan recovery, deterministic Queue duplicates, explicit ack/retry behavior, and same-identity DLQ recovery.
• D1 stores strict foreign-keyed delivery/outbox state; R2 payloads are checksum-bound; default operational diagnostics retain only categories, counts, timestamps, and opaque IDs.
• The runtime capability remains explicitly non-production: D1/R2/Queues are implemented-not-wired; email API/provider/deploy/inbound flags remain false; no Cloudflare production binding was created; experimental sources are excluded from the Node/npm package.

GitHub and deployed regression evidence

• PR CI: https://github.com/haya-inc/hayasend/actions/runs/30274677681
• PR CodeQL: https://github.com/haya-inc/hayasend/actions/runs/30274674509
• exact-main CI: https://github.com/haya-inc/hayasend/actions/runs/30275011785
• exact-main CodeQL: https://github.com/haya-inc/hayasend/actions/runs/30275010723
• exact-main Pages: https://github.com/haya-inc/hayasend/actions/runs/30275012386
• open code-scanning alerts on exact main: 0
• GitHub Pages index and API reference fetched successfully from https://haya-inc.github.io/hayasend/
• latest dependencies verified: npm outdated --json returned {}; npm audit reported 0 vulnerabilities

AWS behavior was re-proved from the exact merged commit in the dedicated hayainc-test account 330599756148, ap-northeast-1, with retain_stack=false:

• run: https://github.com/haya-inc/hayasend/actions/runs/30275263451
• stack: hayasend-it-30275263451-1
• dedicated-account/OIDC identity check, plan/deploy, legacy log-group adoption, deployed API suite, and durable outbox recovery all passed
• cleanup reported Deleted successfully; the payload bucket contents were removed and the workflow's stack, bucket, DynamoDB table, schedule group, managed log-group, and legacy log-group residue gates passed
• the stack was not retained

This completes #102 without widening the claim into Cloudflare provider or production readiness; those remain #103 and #104.