Build a crash-safe ingest workflow

The workflows only orchestrate; all the guarantees live in the stages. Each stage checks for its artefact under a key derived from the document's bytes, does the work only if it is missing, writes the object atomically and records it with INSERT ... ON CONFLICT DO NOTHING. Once that holds, retries, duplicate deliveries and a dead worker can only waste time, never corrupt state, and progress can be read straight from the artefact table. The decision that matters most is to key artefacts by content and configuration, never by a message or run ID.