Follow-up from "Sync organization_id to CI mirror tables"

The following discussions from !254205 (merged) should be addressed:

• @bmarjanovic started a discussion: (+1 comment)

  <🤖>

  issue (non-blocking): This callback won't fire on the main production path that changes organization_id. Organizations::Transfer::GroupsService#transfer_namespaces_and_projects (app/services/organizations/transfer/groups_service.rb) and Organizations::Transfer::TopLevelGroupService (app/services/organizations/transfer/top_level_group_service.rb) both change organization_id via update_all, which bypasses ActiveRecord callbacks. So this after_update on Namespace, and the equivalent after_save on Project, never run during an organization transfer.

  The new triggers still insert rows into namespaces_sync_events and projects_sync_events, but Namespaces::ProcessSyncEventsWorker and Projects::ProcessSyncEventsWorker aren't cron-scheduled. Only Ci::Catalog::Resources::ProcessSyncEventsWorker is in config/schedule.yml. These two only run when a model callback enqueues them, or when Ci::ProcessSyncEventsService re-enqueues after finding leftover events. So after a transfer, ci_namespace_mirrors and ci_project_mirrors can keep the stale organization_id until some unrelated namespace or project save happens to trigger a worker. Usually seconds on GitLab.com, but potentially indefinite on a quiet self-managed instance.

  Since !254210 plans to rely on organization_id on the mirror tables for CI database data isolation, this needs to be fixed before that lands, either here or as a follow-up MR in this series. GroupsService already has the pattern to reuse: it enqueues Ci::Runners::TransferOrganizationWorker and other workers inside ActiveRecord.after_all_transactions_commit do ... end, with a comment explaining that group never joins the transaction because all writes go through update_all.

  ActiveRecord.after_all_transactions_commit do
    Namespaces::SyncEvent.enqueue_worker
    Projects::SyncEvent.enqueue_worker
  end

  </🤖>

• @bmarjanovic started a discussion:

  <🤖>

  nitpick (non-blocking): doc/development/database/ci_mirrored_tables.md (around lines 64-67) still says replication is restricted to a few attributes, traversal_ids from Namespace, and only namespace_id from Project. After this MR, organization_id is also replicated from both Namespace and Project, so that paragraph is out of date.

  Suggest a one-line update to mention organization_id, either here or in a follow-up.

  </🤖>