fix(cleanup): F02 清理失败记录含任务编号的告警，孤儿 xlsx 按保留期回收

- process_formula_export 失败清理受阻时记录不含敏感数据的 WARNING（任务编号+文件名），
  并保留 job.path 使残留文件仍可追踪，而不是清空后失联
- cleanup_formula_exports 新增孤儿 .xlsx 回收：超过 24h 保留期且不属于任何
  未过期成功任务的文件统一回收（覆盖失败任务残留、任务行被级联删除两种来源），
  不触碰仍处于活动任务的文件
- 测试：注入 unlink 权限错误→任务失败状态仍保存+告警可见；恢复权限后回收成功
  且其他任务文件不受影响；失败任务残留/任务行已删/未过期成功/近期文件/非 UUID 命名

tests/test_formula_export_reliability.py

@@ -1,3 +1,4 @@
+import os
 import stat
 from decimal import Decimal
 from io import BytesIO
@@ -306,6 +307,62 @@ def test_formula_export_retry_after_failure_succeeds(workspace, monkeypatch):
     assert not list(Path(job.path).parent.glob(f"{job.pk}.*.tmp"))
 
 
+def test_cleanup_failure_is_logged_and_reclaimed_after_permissions_restored(
+    workspace, settings, monkeypatch, caplog
+):
+    import logging as logging_module
+    from datetime import timedelta
+
+    from django.core.management import call_command
+    from django.utils import timezone
+
+    from finance.exporting import process_formula_export
+
+    ds, *_ = workspace
+    job = _queued_job(ds)
+    user_dir = Path(settings.MEDIA_ROOT) / "formula-exports" / str(job.user_id)
+    user_dir.mkdir(parents=True)
+    target = user_dir / f"{job.pk}.xlsx"
+    target.write_bytes(b"stale workbook")
+    other = FormulaExport.objects.create(
+        dataset=ds,
+        user=ds.created_by,
+        context={"start": "2026-08", "end": "2026-08", "comparison": "yoy", "group": "department"},
+        status="succeeded",
+        expires_at=timezone.now() + timedelta(hours=1),
+    )
+    kept = user_dir / f"{other.pk}.xlsx"
+    other.path = str(kept)
+    other.save(update_fields=["path"])
+    kept.write_bytes(b"active workbook")
+
+    def fail(*args, **kwargs):
+        args[-1].write(b"partial")
+        os.chmod(user_dir, 0o500)
+        raise ValueError("controlled export failure")
+
+    monkeypatch.setattr("finance.exporting.build_formula_workbook", fail)
+    with pytest.raises(ValueError, match="controlled export failure"):
+        process_formula_export(job.pk)
+    job.refresh_from_db()
+    assert job.status == "failed"
+    assert job.path == str(target)
+    warnings = [r for r in caplog.records if r.levelno == logging_module.WARNING]
+    assert warnings and all(str(job.pk) in record.getMessage() for record in warnings)
+
+    os.chmod(user_dir, 0o700)
+    old = (timezone.now() - timedelta(hours=25)).timestamp()
+    for leftover in [target, *user_dir.glob(f"{job.pk}.*.tmp"), kept]:
+        os.utime(leftover, (old, old))
+    call_command("cleanup_formula_exports")
+
+    job.refresh_from_db()
+    assert not target.exists()
+    assert not list(user_dir.glob(f"{job.pk}.*.tmp"))
+    assert job.path == ""
+    assert kept.read_bytes() == b"active workbook"
+
+
 def test_formula_workbook_rejects_unclassified_label_collision(workspace):
     from decimal import Decimal