## Context
Part of the workflow → core migration. Before enabling
`IS_WORKFLOW_DISPATCH_FROM_CORE_ENABLED` per workspace, the drift signal
that gates the rollout must be trustworthy. Two bugs in the (already
merged) consistency cron made it lie in both directions. This PR fixes
only those two; no new machinery.
The actual pre-flight gate is a read-only SQL query run per batch of
workspaces, so the heavier repair-command idea was dropped.
## What this does
**1. Exclude soft-deleted trigger rows from the automated-trigger drift
check.**
`checkAutomatedTriggerSync` read the workspace
`workflowAutomatedTrigger` table without a `deletedAt` filter (the
sibling workflow/version checks have one). Workflow soft-delete
soft-deletes the trigger row but removes the core-map entry, so every
soft-deleted automated workflow emitted a permanent false
`inTableNotCache` drift — inflating the exact metric meant to gate the
flag.
**2. Enumerate active workspaces in the consistency cron.**
The scan was `SELECT DISTINCT "workspaceId" FROM core."workflow"`: a
workspace whose mirror never succeeded has zero core rows and was
therefore never checked — the worst-drifted tenants were invisible. It
now enumerates ACTIVE workspaces and skips those with no (non-deleted)
workflow rows, so cost stays close to actual workflow usage.
No behavior change beyond the drift metrics themselves.
Thomas Trompette
b7e556bcfc