`Job.refresh(*restrictions)` narrowed key_source to add jobs and then
reused the narrowed key_source in its cleanup step. Every job older than
stale_timeout whose key fell outside the restriction therefore looked
vanished and was deleted, including jobs reserved by other workers and
error records. `populate(*restrictions, reserve_jobs=True)` calls
refresh this way. Cleanup now checks keys against the unrestricted
key_source; the restrictions still limit which jobs are added and
re-pended.

Success and error records whose key has left both key_source and the
target (because the upstream row was deleted) are now removed on every
refresh, whatever their age, instead of lingering until stale_timeout.
Records of rows that still exist are kept. The age-based check for the
other statuses, and stale_timeout=0 skipping it, are unchanged.

Cleanup now issues one DELETE per step instead of an existence query
and a DELETE for each key.

Refs #1577

(cherry picked from commit fc12194ed9e13988f82b09a397b3c3373b244853)

Review follow-up: the stale_timeout entry still said 0 skips the cleanup, but the success and error records of keys that have left both key_source and the target are now removed whatever the timeout. The test for records of existing rows covers a fresh record only, and its docstring now says so.

(cherry picked from commit 6a1e171)