Implement ACTIVITY-WP-0021 production automation reliability

Root-cause IssueSink 503 (dead Forgejo PAT on issue-core), add state-hub
task sink path B, log runs before emit, harden sync_schedules, deterministic
SBOM/triage reports, DB probe thrash fix, and prod automation-status helper.

src/activity_core/schedule_manager.py

@@ -323,10 +323,15 @@ async def upsert_schedule(client: Client, defn: ActivityDefinition) -> ScheduleH
 
         # Sync pause state explicitly (update replaces the schedule object
         # but pause state is part of ScheduleState, already embedded above).
-        if defn.enabled:
-            await handle.unpause()
-        else:
-            await handle.pause(note="disabled via upsert_schedule")
+        # ACTIVITY-WP-0021: pause/unpause can race with an in-flight schedule
+        # action; treat those as non-fatal so reconcile can finish the update.
+        try:
+            if defn.enabled:
+                await handle.unpause()
+            else:
+                await handle.pause(note="disabled via upsert_schedule")
+        except (RPCError, ScheduleAlreadyRunningError):
+            pass
 
     # ACTIVITY-WP-0014: missed-fire recovery is now handled natively by the
     # schedule's catchup_window (see _build_schedule), which the server applies