fix(ingestion): unify store + watermark + job-complete in single transaction

Previously, drain_resource_events, drain_mr_closes_issues, and
drain_mr_diffs each opened a transaction only for the job-complete +
watermark update, but the store operation ran outside that transaction.
If the process crashed between the store and the watermark update, data
would be persisted without the watermark advancing, causing silent
duplicates on the next sync.

Now each drain function opens the transaction before the store call and
commits it only after both the store and the watermark update succeed.
On error, the transaction is explicitly dropped so the connection is
not left in a half-committed state.

Also:
- store_resource_events no longer manages its own transaction; the caller
  passes in a connection (which is actually the transaction)
- upsert_mr_file_changes wraps DELETE + INSERT in a transaction internally
- reset_discussion_watermarks now also clears diffs_synced_for_updated_at
- Orchestrator error span now includes closes_issues_failed + mr_diffs_failed

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/ingestion/merge_requests.rs

@@ -380,7 +380,8 @@ fn reset_discussion_watermarks(conn: &Connection, project_id: i64) -> Result<()>
              discussions_sync_attempts = 0,
              discussions_sync_last_error = NULL,
              resource_events_synced_for_updated_at = NULL,
-             closes_issues_synced_for_updated_at = NULL
+             closes_issues_synced_for_updated_at = NULL,
+             diffs_synced_for_updated_at = NULL
          WHERE project_id = ?",
         [project_id],
     )?;