feat(core-shared): grace-purge soft-deleted rows + boot registration

The retention purge job gated its whole body on activeRetention while
every collection declares only postDeletion, and no app ever called
registerRetentionPurgeJobs — retention was dead end to end (audit
findings A2 + A3). The DSR soft delete now stamps a deletedAt tombstone
on postDeletion collections (kept distinct from processingRestrictedAt
so an Art. 18 restriction never feeds the purge), the job grace-purges
tombstoned rows past postDeletion.duration with the declared action,
core-cms injects the tombstone field + Payload task definitions, and
bindAllProduction enqueues the first purge cycle at boot.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

packages/core-cms/package.json

@@ -18,6 +18,8 @@
     "@payloadcms/richtext-lexical": "^3.14.0",
     "@repo/auth": "workspace:*",
     "@repo/blog": "workspace:*",
+    "@repo/core-audit": "workspace:*",
+    "@repo/core-shared": "workspace:*",
     "@repo/marketing-pages": "workspace:*",
     "@repo/media": "workspace:*",
     "@repo/navigation": "workspace:*",