The convex-contract job left one preview deployment behind per PR, and
after about 25 merged PRs the team hit its deployment quota of 40, so
every PR failed with DeploymentQuotaReached. The job now records the
preview's URL when Convex claims it (via --cmd, which runs before the
push), sets it to expire in an hour, and deletes it in a final always()
step through the Management API using the same preview deploy key.

The Windows upgrade and rollback test removed the app support folder
straight after killing Icarus, so a helper still holding 000003.log made
the delete fail, and because it threw inside finally it hid the real
result. Cleanup now waits for Icarus and any process using the support
folder to exit, retries the delete, and only fails the run when the test
itself passed.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>