Delete Dedicated Run

Delete a dedicated run: helm uninstall + namespace delete + DB cleanup.

Idempotent. Safe to call repeatedly. Cleans up the linked Job row too (which uninstalls the helm release on the customer cluster). Soft- deletes the RFTRun row (matches the existing run-delete UX - Billing refs are preserved). Access is per-row: verify_run_ownership accepts personal runs the caller owns and team runs the caller is a member of.