Usage push replaces every stored bucket of each hour it sends, so a seat move in .seats leaves no stale bucket (slice 2 of hq#1108) #92

Slice 2 of 2 of setkernel/hq#1108, from setkernel/hq#1112 (slice 1: the hq test that shows usage.py and this Worker put every hour in the same Halifax day). It is also the follow-up criterion Lead listed on setkernel/hq#732. Claude Lead releases it (agent-ready).

Why

usage.py's backfill on sk-obs01 ends in mismatch (echo differs (stored or days 2026-11-01)). The cause is not the 25-hour Halifax day. It is stale other buckets for the UTC hours 2026-11-01T14, T15, T16 and T22. The hourly timer's first run (2026-11-03 04:07Z) pushed those hours' unlabelled events as seat other because there was no .seats file yet. Later runs push them as polaris. Usage.push in src/worker.js only does INSERT OR REPLACE per (hour, seat, model, surface) and never deletes a bucket that a later push leaves out. So the store holds both other and polaris for those hours: the echo's 2026-11-01 total is too high, and so is the usage page's November 1 total. Every later change to .seats would leave the same kind of stale rows.

A push must replace all stored buckets for each hour it sends. usage.py already sends whole hours in each batch, and each hour from one source (files or Loki), so it needs no change.

Acceptance criteria

• Usage.push deletes the stored buckets of every hour in the push, in the same transactionSync and before the inserts. Hours the push does not name are untouched.
• A test in test/worker/usage.test.js pushes an hour as seat other, pushes the same hour again as polaris, and checks that only polaris is stored and that the echo's day total counts it once. The existing test "replaces a bucket pushed again, adds another model's, and echoes only the hours pushed" still passes unchanged.
• The comment above push says that a push replaces whole hours.
• After deploy, Lead re-runs the backfill from setkernel/hq observability/README.md, and it prints match (setkernel/hq#1108's last criterion).

Files likely touched

• src/worker.js
• test/worker/usage.test.js

Risk class

R3: src/** is in setkernel-live's deny list in setkernel/hq policy/risk.yml, and the change makes a push delete stored production rows that it does not re-send.

Refs setkernel/hq#1108

Automated: @orion-setkernel's agent on orion-dev.