Prevent concurrent attestation from generating multiple envelopes

[mkysel]

Serialize attestation processing and identity update inserts to prevent concurrent attestation from generating multiple envelopes in pkg/payerreport/store.CreateAttestation and pkg/payerreport/workers.AttestationWorker.AttestReports

Introduce a transaction-scoped advisory locking helper and apply row-level locking to coordinate attestation and identity update operations. The changes add db.AdvisoryLocker and db.TransactionScopedAdvisoryLocker, replace sequence-based identity update locks with originator node ID-based locks, lock payer report rows during attestation, and serialize worker execution via a fixed advisory lock.

• Add db.AdvisoryLocker and db.TransactionScopedAdvisoryLocker with LockIdentityUpdateInsert and LockAttestationWorker methods in advisory_lock.go and constructor functions
• Generate queries.AdvisoryLockWithKey in advisory_locks.sql.go with SQL defined in advisory_locks.sql
• Remove queries.AdvisoryLockIdentityUpdateInsert and its SQL in identity_updates.sql.go and identity_updates.sql
• Add queries.FetchPayerReportLocked with FOR UPDATE in payer_reports.sql.go and payer_reports.sql
• Update indexer.IdentityUpdateStorer.StoreLog to use db.NewAdvisoryLocker().LockIdentityUpdateInsert keyed by originator node ID in identity_update_storer.go
• Extend payerreport.IPayerReportStore to expose GetAdvisoryLocker and implement it in interface.go and store.go
• Modify payerreport.Store.CreateAttestation to lock the report row, short-circuit non-pending statuses, and stage a single originator envelope in store.go
• Serialize HA worker processing with a transaction-scoped advisory lock in attestation.go
• Add a concurrency test ensuring a single staged envelope in store_test.go

📍Where to Start

Start with the payerreport.Store.CreateAttestation call path in store.go, then review the advisory locking helper in db.TransactionScopedAdvisoryLocker and db.AdvisoryLocker in advisory_lock.go, followed by queries.FetchPayerReportLocked in payer_reports.sql.go and the worker changes in payerreport.AttestationWorker.AttestReports in attestation.go

---

Macroscope summarized b54fd81.

[graphite-app]

How to use the Graphite Merge Queue

Add either label to this PR to merge it via the merge queue:

• Queue - adds this PR to the back of the merge queue
• Hotfix - for urgent hot fixes, skip the queue and merge this PR next

You must have a Graphite account in order to use the merge queue. Sign up using this link.

An organization admin has enabled the Graphite Merge Queue in this repository.

Please do not merge from GitHub as this will restart CI on PRs being processed by the merge queue.