Implement stable account-region binding for Kura warm handoffs

Context

Warm Kura handoffs currently derive customer endpoint publication from source and target server rows. Production stays disabled in #12002 because neither row is a stable owner across a move.

Completion criteria

• Introduce a stable account-region binding that owns the customer endpoint independently of either server row.
• Transfer that binding atomically during promotion and derive endpoint publication from it.
• Preserve fail-closed behavior when ownership is missing or ambiguous.
• Cover retries and controller restarts at every handoff phase.

Rollout

1. Exercise forced moves in staging while continuously reading and writing through the customer endpoint.
2. Enable one staging account and verify endpoint continuity and rollback signals.
3. Enable a small production allowlist.
4. Expand only after continuity and rollback alerts remain clean.

Production warm handoffs must remain disabled until these criteria are complete.

No GitHub comments yet.