fix(release): drain the retention reaper instead of assuming one batch

The device-auth suite freezes its clock at a calendar date, and once its
revoked fixture families aged past the reaper's 24-hour window they sort
ahead of the retention test's chain and fill the whole default family
batch of 4, so a single reap pass no longer removed the chain and the
new policy-enforcing workspace job started failing mid-day. Run the job
to completion the way its schedule would — batched drains promise
eventual removal, not first-pass removal — and assert the accumulated
totals; verified against a fresh sequential Postgres run.

Co-authored-by: Cursor <cursoragent@cursor.com>