[everpcpc]

Summary

• Stop orphan cleanup when download statuses cannot be read from GRDB instead of treating the failure as an empty status map.
• Propagate cleanup failures through the launch, manual cleanup, and sync callers; manual cleanup now surfaces the database error rather than reporting that nothing needs cleaning.
• Document the invariant that an unreadable download-intent set must never authorize file deletion.

This addresses the deletion path exposed by #1330. The attached log does not include the SQLite failure or the reported sync, so the underlying SQLite error 14 still needs reproduction; this change prevents that database failure from turning valid downloaded books into apparent orphans.

Testing

• make format
• make build (iOS, macOS, and tvOS)

Related to #1330

🤖 Generated with Claude Code