Data Removal broker work is queued

Data Removal can now schedule broker work by priority, recover interrupted jobs, retry failures with backoff, prevent duplicate work, and pace requests per broker. The first RocketReach playbook prepares its email-verified removal flow without sending customer data. External submission remains disabled while production profile encryption and live testing are incomplete.