feat(artifacts): add fenced reconciliation recovery

apps/admin-api/src/main.rs

@@ -4,6 +4,7 @@ use admin_api::{
     app::build_app,
     auth::{AuthSettings, BootstrapAdminConfig},
     pool_metrics::spawn_postgres_pool_metrics,
+    reconciliation::{open_reconciliation_store, spawn_artifact_reconciliation},
     service::AdminServiceBuilder,
     state::AppState,
 };
@@ -202,6 +203,7 @@ async fn run(
     let secret_crypto =
         verified_startup_secret_crypto(&registry, config.runtime.master_key.expose_secret())
             .await?;
+    let artifact_store = open_reconciliation_store(config.storage_root.clone()).await?;
     let outbound_http_policy = crank_runtime::OutboundHttpPolicy::try_new_with_limits(
         config.runtime.outbound.allowed_hosts.clone(),
         config.runtime.outbound.denied_hosts.clone(),
@@ -216,7 +218,7 @@ async fn run(
     let identity_provider =
         PasswordIdentityProvider::new(registry.clone(), auth_settings.password_pepper.clone());
     let service = AdminServiceBuilder::new(
-        registry,
+        registry.clone(),
         config.storage_root.clone(),
         auth_settings,
         secret_crypto,
@@ -229,6 +231,7 @@ async fn run(
     if config.demo_seed {
         service.seed_demo_assets().await?;
     }
+    spawn_artifact_reconciliation(registry, artifact_store).await;
     spawn_invocation_log_cleanup(service.clone(), config.invocation_log_retention_days);
     let state = AppState {
         service,