Milestone 2 groundwork (local only, no new infrastructure)

• Migration 0015 (build_pipeline): adds build_jobs and build_events, plus new deployments columns environment, build_job_id, trigger, alias_url and promoted_from. It only adds things. It has been applied to the local D1 and in tests only; the remote database waits for GO — PUBLISH.
• State machine (src/lib/build/state.ts): queued → claimed → installing → building → uploading → succeeded. Any active state can move to failed, canceled or timed_out, and terminal states never change. claimed may skip straight to uploading for direct (no-build) jobs. Each phase has a timeout, and build states map onto the existing deployments.status values.
• Jobs (src/lib/build/jobs.ts):
  • Every state change is a conditional UPDATE … WHERE status = from RETURNING, so if two workers try to move the same job, only one wins.
  • Idempotency comes from a unique key per project plus a SHA-256 of project, environment, trigger source and commit. If two requests race on the same key, both get the winning job back.
  • Only one active job is allowed per project and environment, enforced by a unique partial index; a second one gets a 409.
  • Cancel: a queued job is canceled immediately. A running job gets cancel_requested, the executor sees it on its next heartbeat and finishes the cancel. Canceling a finished job is a no-op.
  • Retry happens only for transient error codes. It uses exponential backoff with full jitter and stops at max_attempts (at most 5). The retry job keeps retry_of and the commit, and does not take the original's idempotency key.
  • A sweeper marks jobs whose heartbeat is older than their phase timeout as timed out and retries them.
  • The saved config snapshot rejects keys that look like secrets.
• Logs: appendEvent gives each line the next sequence number inside the SQL statement, redacts it with sanitizeLog (known secrets passed in, plus token-shaped strings) and caps each job at 5000 lines. listEvents only returns a job's lines to its owner.
• Redaction additions in sanitize.ts: credentials inside URLs, npm tokens, AWS key ids and PEM private keys. Commit SHAs are kept.
• Commit SHA on deploys: startDeploy now turns the branch into a commit first, reads the file tree at that exact commit and saves commit_sha. Passing a 40-character hex ref redeploys that exact commit. A branch that doesn't exist returns 422.

Nothing runs these jobs yet. A Queue consumer and the Containers executor still need the owner's approval (see CREDENTIALS-NEEDED.md).