fix(desktop-task): drop LEFT JOIN in lease query so FOR UPDATE locks only desktop_tasks

Postgres rejects FOR UPDATE on the nullable side of a LEFT JOIN, which
made LeaseNextQueuedDesktopTask fail under contention. Replace the join
with a NOT EXISTS subquery, scope the row lock to the dt alias, and add
a regression test plus warn-level logging on lease query failures so
similar issues are easier to diagnose.

server/internal/tenant/repository/queries/desktop_task.sql

@@ -63,7 +63,6 @@ LIMIT 1;
 WITH candidate AS (
     SELECT dt.desktop_id
     FROM desktop_tasks AS dt
-    LEFT JOIN desktop_publish_jobs AS j ON j.desktop_id = dt.job_id
     WHERE dt.target_client_id = sqlc.arg(client_id)
       AND dt.status = 'queued'
       AND (
@@ -72,8 +71,12 @@ WITH candidate AS (
       )
       AND (
         dt.kind <> 'publish'
-        OR j.desktop_id IS NULL
-        OR j.status = 'queued'
+        OR NOT EXISTS (
+            SELECT 1
+            FROM desktop_publish_jobs AS j
+            WHERE j.desktop_id = dt.job_id
+              AND j.status <> 'queued'
+        )
       )
     ORDER BY dt.lane_weight DESC,
         dt.priority DESC,
@@ -81,7 +84,7 @@ WITH candidate AS (
         dt.created_at ASC,
         dt.desktop_id ASC
     LIMIT 1
-    FOR UPDATE SKIP LOCKED
+    FOR UPDATE OF dt SKIP LOCKED
 )
 UPDATE desktop_tasks AS t
 SET active_attempt_id = sqlc.arg(attempt_id),