[Enhancement] Define retention and cleanup for expired instance status records #7717

Problem

InstanceCheckService marks long-missing instances DELETED but retains entries in its in-memory table. syncDB subsequently processes all entries every round; startup loads persisted records again. There is no expiry cleanup in this service. A deployment with changing container addresses can accumulate historical identities and recurring persistence work.

This is a lifecycle/capacity enhancement; no production memory leak or load threshold has been measured.

Scope and acceptance criteria

• Define configurable retention for expired observations, separate from liveness/offline thresholds and audit/history requirements.
• Bound in-memory retention and database cleanup work, including a policy for legacy rows and optional archival.
• Prevent an old cleanup task from deleting a newly renewed/restarted identity; preserve namespace isolation and define the cluster authority for cleanup.
• Never purge an active instance merely because it is absent from one Admin node's local map.
• Test expiration, renewal concurrent with cleanup, restart, multiple namespaces and master changes with controlled time.
• Measure recurring database work and retained identities under address churn; document retention and operator expectations.

Related: #7694 defines expired-state semantics; #7697 covers status-query authority; #6496 covers persistence task failure. Do not conflate this policy with deleting gateway configuration or backend service registrations.