[B2C][BOOKING] Tentative-cleanup vs payment-webhook confirmation race — paid customer can lose their slot

[teetangh]

Problem

scripts/appointments/cleanup-tentative-slots.ts:62-99 does a plain findMany + deleteMany with no row locks and no payment-state guard beyond its window, while the payment webhook concurrently flips the same slots confirmed. A capture landing during the sweep can leave a SUCCEEDED payment whose slots were deleted — dangling appointment, unrecoverable without manual ops.

Fix shape

Serializable tx or skip rows whose payment is in any non-terminal state; same CAS-claim idiom as the #476-era sweeps. Chaos runbook scenario 5 reproduces it.