feat(compliance): add content compliance detection across tenant, ops, and clients

Implements the Revision 8/9 compliance design: tenant + ops backends, ops-web
content-safety pages, admin-web editor/publish gate integration, desktop publish
block surfacing, and supporting migrations / shared types / config plumbing.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/internal/tenant/repository/queries/desktop_task.sql

@@ -6,7 +6,9 @@ INSERT INTO desktop_publish_jobs (
     created_by_user_id,
     title,
     content_ref,
-    scheduled_at
+    scheduled_at,
+    article_id,
+    article_version_id
 )
 VALUES (
     sqlc.arg(desktop_id),
@@ -15,7 +17,9 @@ VALUES (
     sqlc.arg(created_by_user_id),
     sqlc.arg(title),
     sqlc.arg(content_ref),
-    sqlc.narg(scheduled_at)
+    sqlc.narg(scheduled_at),
+    sqlc.narg(article_id),
+    sqlc.narg(article_version_id)
 )
 RETURNING *;
 
@@ -59,12 +63,18 @@ LIMIT 1;
 WITH candidate AS (
     SELECT dt.desktop_id
     FROM desktop_tasks AS dt
+    LEFT JOIN desktop_publish_jobs AS j ON j.desktop_id = dt.job_id
     WHERE dt.target_client_id = sqlc.arg(client_id)
       AND dt.status = 'queued'
       AND (
         sqlc.narg(kind)::text IS NULL
         OR dt.kind = sqlc.narg(kind)::text
       )
+      AND (
+        dt.kind <> 'publish'
+        OR j.desktop_id IS NULL
+        OR j.status = 'queued'
+      )
     ORDER BY dt.lane_weight DESC,
         dt.priority DESC,
         COALESCE(dt.enqueued_at, dt.created_at) ASC,