fix(scheduler): lifecycle gate excluded NULL-state check targets

The B1 target-state filter `tgt.state NOT IN ('deprecated','destroyed')`
evaluates to NULL (unknown) when a target's state is NULL, which the WHERE
clause treats as false — so freshly-seeded entities without an explicit state
(the 20 TLS certificates) were silently dropped from ListEnabledCheckDefs and
never monitored. Treat NULL state as active (only explicit deprecated/
destroyed is excluded): `tgt.state IS NULL OR tgt.state NOT IN (...)`.

internal/db/queries/operations.sql

@@ -65,7 +65,7 @@ FROM check_defs cd
 JOIN entities e ON e.id = cd.entity_id
 LEFT JOIN entities tgt ON tgt.id = cd.target_id
 WHERE cd.enabled = true
-  AND (tgt.id IS NULL OR tgt.state NOT IN ('deprecated', 'destroyed'))
+  AND (tgt.id IS NULL OR tgt.state IS NULL OR tgt.state NOT IN ('deprecated', 'destroyed'))
   AND (cd.last_run_at IS NULL
        OR cd.last_run_at <= now() - make_interval(secs => cd.interval_s));
 

internal/db/sqlcgen/operations.sql.go

@@ -698,7 +698,7 @@ FROM check_defs cd
 JOIN entities e ON e.id = cd.entity_id
 LEFT JOIN entities tgt ON tgt.id = cd.target_id
 WHERE cd.enabled = true
-  AND (tgt.id IS NULL OR tgt.state NOT IN ('deprecated', 'destroyed'))
+  AND (tgt.id IS NULL OR tgt.state IS NULL OR tgt.state NOT IN ('deprecated', 'destroyed'))
   AND (cd.last_run_at IS NULL
        OR cd.last_run_at <= now() - make_interval(secs => cd.interval_s))
 `