fix(publish): cancel queued publish tasks when the article is unavailable

Stale publish jobs for deleted or invalid articles previously lingered in the
queue and kept failing compliance rechecks. Now they are cancelled cleanly and
batch/article publish status is recalculated.

- cancel queued desktop tasks, jobs and publish records on article delete
- detect deleted articles and invalid-article-version compliance errors during
  the client publish recheck and cancel the affected tasks
- add cancelQueuedPublishTasksForUnavailableArticle helper and a unit test for
  the compliance-error classifier

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

server/internal/tenant/app/desktop_task_service_test.go

@@ -4,6 +4,8 @@ import (
 	"regexp"
 	"strings"
 	"testing"
+
+	"github.com/geo-platform/tenant-api/internal/shared/response"
 )
 
 func TestDesktopTaskRecoverySelectQueryMatchesRecoveredLeaseScanOrder(t *testing.T) {
@@ -136,6 +138,17 @@ func TestResolvePublishRecoveryOutcome(t *testing.T) {
 	}
 }
 
+func TestIsComplianceInvalidArticleVersionError(t *testing.T) {
+	t.Parallel()
+
+	if !isComplianceInvalidArticleVersionError(response.ErrBadRequest(41005, "invalid_article_version", "article version does not belong to this article")) {
+		t.Fatal("invalid article version compliance errors should be treated as stale publish tasks")
+	}
+	if isComplianceInvalidArticleVersionError(response.ErrServiceUnavailable(41004, "compliance_engine_unavailable", "compliance gate failed closed")) {
+		t.Fatal("compliance engine failures should not be treated as stale publish tasks")
+	}
+}
+
 func recoverDesktopTaskSelectColumns(query string) []string {
 	re := regexp.MustCompile(`(?is)select\s+(.*?)\s+from\s+desktop_tasks`)
 	match := re.FindStringSubmatch(query)