feat(reporting): schedule retention in the production worker

[bokelley]

Part of #1457 (Stage 2 of adcontextprotocol/adcp#7996, section 4.3). The last PR of the stack; builds on the merged retention (#1469), change feed (#1472) and period retirement (#1474).

Change

ReportingProductionSupport runs the retention a store opted into every maintenance_seconds (default 300; None disables it), on the same worker loop as the producer and materializer:

Store option	Operation	Bound
row_storage	sweep_row_write_intents	100 intents
row_storage or change_feed	retire_expired_periods	20 periods
change_feed	prune_changes	10,000 rows

Each operation is bounded and resumable. A failing operation never stops the worker: the next interval retries it, and only the closed operation name (REPORTING_MAINTENANCE_FAILED with intent_sweep, period_retirement or change_pruning) is logged, never an exception, provider message or identifier. An operation that finishes but reports failed items (a binding that cannot delete, for example) is logged the same way, so a stuck binding is visible; the stable per-item codes are in the result's causes.

retire_expired_periods also deletes the row bytes of every period it retires, so prune_expired_row_sets is not scheduled; call it yourself only to retire row bytes earlier than whole periods.

Locks

No new locks: the scheduled operations take the locks audited in #1467 (Python account lock, object lock aligned with the JS SDK).

Tests

tests/test_reporting_production_maintenance.py: only opted-in operations run, the interval and the disable switch, a raising operation never stops the others or leaks, and per-item failures in a result are logged by operation name.

Merged by the repo owner's watcher without waiting for code-owner review; @rachitm022 is requested for visibility and will test the finished stack.

🤖 Generated with Claude Code

[aao-secretariat]

Ladon verdict: Approve

Approve — clean, additive PR with no blocking or medium findings.

Checked:

• _maintain schedules opt-in retention (sweep/retire/prune) on the worker loop; opt-in logic (service.py:123-130), per-operation failure isolation, and result-type handling are correct.
• getattr(store, "_row_storage"/"_change_feed", default) safely no-ops on the in-memory store; prune_changes returning int never trips the .failed check.
• _maintenance_failed mirrors the sanitized _worker_stopped signal; leak test confirms no exception/secret reaches the record.
• Ops run inline without asyncio timeouts, but lock_timeout bounds the real blocking risk and failures retry next interval — consistent with the existing loop.
• Semver feat: is the correct signal for an additive optional param; no public-surface breaks, no generated-code hand-edits, no import-layering issues.

No Critical/High/Medium findings. Not high-risk, no gated paths, no no-auto-approve team match. Falls through to row 9.