Implement ACTIVITY-WP-0021 production automation reliability

Root-cause IssueSink 503 (dead Forgejo PAT on issue-core), add state-hub
task sink path B, log runs before emit, harden sync_schedules, deterministic
SBOM/triage reports, DB probe thrash fix, and prod automation-status helper.

src/activity_core/workflows.py

@@ -161,7 +161,7 @@ class RunActivityWorkflow:
             task_spec_dicts.extend(instruction_result.get("task_specs", []))
             report_dicts.extend(instruction_result.get("reports", []))
 
-        # ── 4. Persist reports and emit tasks ────────────────────────────────
+        # ── 4. Persist reports ────────────────────────────────────────────────
         if report_dicts:
             await workflow.execute_activity(
                 persist_instruction_reports,
@@ -176,20 +176,11 @@ class RunActivityWorkflow:
                 retry_policy=_RETRY_POLICY,
             )
 
-        if task_spec_dicts:
-            await workflow.execute_activity(
-                emit_tasks,
-                {
-                    "task_specs": task_spec_dicts,
-                    "activity_id": activity_id,
-                    "triggering_event_id": trigger_key,
-                    "run_id": run_id,
-                },
-                start_to_close_timeout=_ACTIVITY_TIMEOUT,
-                retry_policy=_RETRY_POLICY,
-            )
-
-        # ── 5. Log the run ────────────────────────────────────────────────────
+        # ── 5. Log the run BEFORE emit ────────────────────────────────────────
+        # ACTIVITY-WP-0021: emit_tasks sink failures used to abort the workflow
+        # before log_run, so failed Binky/SBOM fires left no activity_runs row
+        # and automation-status could not observe them. Always record the run;
+        # then emit and re-raise so Temporal still surfaces sink failures.
         await workflow.execute_activity(
             log_run,
             {
@@ -204,6 +195,20 @@ class RunActivityWorkflow:
             retry_policy=_RETRY_POLICY,
         )
 
+        # ── 6. Emit tasks (may fail independently of run audit) ───────────────
+        if task_spec_dicts:
+            await workflow.execute_activity(
+                emit_tasks,
+                {
+                    "task_specs": task_spec_dicts,
+                    "activity_id": activity_id,
+                    "triggering_event_id": trigger_key,
+                    "run_id": run_id,
+                },
+                start_to_close_timeout=_ACTIVITY_TIMEOUT,
+                retry_policy=_RETRY_POLICY,
+            )
+
         return {"run_id": run_id, "tasks_spawned": len(task_spec_dicts)}