This repair is a release candidate until migration 20261020000088 completes
the required staging and production checks.

When a failed membership setup cannot safely be removed, its linked promotion
reservation now stays with the setup, rather than being released separately.
Successful cleanup and retry use the same operation identity, so a completed
removal does not release the promotion twice.

Existing venue, client, payment-history and permission checks still apply.
This change does not remove active memberships, change offer eligibility or
prices, send client messages, or authorize an operator to clean up a live
customer record without the existing safety checks.