#3035 Datastore rework Phase 2: remaining serve direct pushes commit through root units (no behaviour change)

Follow-up to swamp-club#3034, which moved the 14 pushChangedToRemote call sites, executeWorkflowWithLocks and the serve hand marks into root units of work. These serve pushes still call syncService.pushChanged directly and are pinned in PINNED_SERVE_RAW_PUSHES (integration/serve_root_unit_rules_test.ts):

• Success-only handler pushes, which push after the reply and only when the request succeeded, so they need a flush that skips on failure and cancel: model.create, model.delete, model.edit (model_handlers.ts); vault.create, vault.edit (vault_handlers.ts); vault.migrate (admin_handlers.ts); workflow.create, workflow.edit, workflow.delete (workflow_handlers.ts).
• Run-path pushes under the shared gate: handleModelMethodRun (two sites, model_handlers.ts), the workflow.resume handler (workflow_handlers.ts) and resume_launcher.ts.

Goal: each runs in a runInRootUnitOfWork root whose flush is today's push, with marks, push count, push timing relative to the reply and gate, and failure behaviour unchanged. The characterization rows for these handlers switch on rootUnit.serve with syncOrder pinned from pre-change code, and PINNED_SERVE_RAW_PUSHES shrinks accordingly.

Out of scope: per-step model lock pushes (acquireModelLocks flush), pollers, GC services, startup hydration, the extension lockfile.

Related: tracking swamp-club#2865; built on swamp-club#3032 and swamp-club#3034.