fix(models): declare DispatchOutbox.execution_id + cue_id FKs (parity port of cueapi/cueapi#594)

[mikemolinet]

Summary

Re-port of closed PR #44. That PR was on a stale base ~8880 deletions behind current main; this is the same 2-3 line fix freshly cut against main HEAD (f9ec4ea).

Adds the ForeignKey() wrappers on DispatchOutbox.execution_id and cue_id that match the DB-level FKs already declared in migration 002 (both ondelete=CASCADE). The model omission was benign drift — the DB constraint was still enforced — but broke any future SQLAlchemy ORM relationship() that wanted to traverse these columns.

What lands

app/models/dispatch_outbox.py: 2 column declarations get FK wrappers + import bump.

-from sqlalchemy import Boolean, CheckConstraint, Column, DateTime, Integer, String, Text, func
+from sqlalchemy import Boolean, CheckConstraint, Column, DateTime, ForeignKey, Integer, String, Text, func
 ...
-    execution_id = Column(UUID(as_uuid=True), nullable=True)
-    cue_id = Column(String(20), nullable=True)
+    execution_id = Column(
+        UUID(as_uuid=True),
+        ForeignKey("executions.id", ondelete="CASCADE"),
+        nullable=True,
+    )
+    cue_id = Column(
+        String(20),
+        ForeignKey("cues.id", ondelete="CASCADE"),
+        nullable=True,
+    )

tests/test_qa_observability.py: the 3 outbox-cleanup test fixtures previously inserted DispatchOutbox rows with synthetic UUIDs for execution_id + synthetic cue_id strings. Those worked while the model omitted the FKs (test DB created via Base.metadata.create_all only enforced model-declared constraints). With FKs added, the synthetic inserts hit ForeignKeyViolationError.

Fix: introduce _create_anchor_execution(db_session) helper that creates a real User + Cue + Execution row and returns the execution id. Test fixtures use that to anchor the FK; cue_id is set to None (these tests care about outbox lifecycle, not cue association).

Same shape as private cueapi's tests/test_qa_observability.py post-FK-declaration (same _create_anchor_execution helper, same cue_id=None discipline).

Test plan

• All 6 outbox-cleanup + device-code cleanup tests pass locally (6 passed)
• Full local suite: 832 passed + 7 pre-existing SDK-integration env failures (unchanged from main; not from this PR)
• Verified DB-level FK already exists in migration 002 (migration_002_executions_and_outbox.py); this PR only adds the model-side declaration
• Matches private cueapi shape verbatim
• CI green
• Admin-merge per agents-merge-own-PRs directive

🤖 Generated with Claude Code

[github-actions]

Parity check

This PR modifies files tracked in parity-manifest.json:

• app/models/dispatch_outbox.py

Please confirm one of the following in a reply or PR description update:

1. The equivalent change has been applied to the private cueapi monorepo. Link the PR.
2. This change is OSS-only and does not need porting. Briefly explain why (e.g. "fixes a bug that only exists in the OSS build").
3. A follow-up issue has been filed to port the reverse direction. Link the issue.

This is a soft check — it does not block merge. The goal is visibility, not friction. See HOSTED_ONLY.md for the open-core policy.