Scheduled-message listing does not carry the envelope's tenant (ScheduledMessageSummary has no TenantId) #4666

Gap

IScheduledMessages.QueryAsync returns ScheduledMessageSummary rows with no tenant. On a conjoined (single database, many tenants) service, a scheduled message's tenant exists only inside the serialized envelope body, and none of the stores read that body:

• RDBMS (MessageDatabase.ScheduledMessages.QueryAsync) selects id, message_type, execution_time, received_at, attempts. The incoming table has no tenant column.
• Oracle, RavenDb and CosmosDb: same shape. The body is on the row or document, but it is never read.

So a monitoring tool listing scheduled messages cannot tell whose work a message is before an operator cancels or reschedules it. Found from the CritterWatch side (JasperFx/CritterWatch#1369). There, a test proves the stored envelope keeps TenantId while the listing has no field to show it.

Proposed fix

• Add string? TenantId to ScheduledMessageSummary.
• Read the body in each store's scheduled query and take the tenant from it. A new EnvelopeSerializer.TryReadTenantId(byte[]?) returns null for an empty or unreadable body, so one bad row costs that row its tenant and doesn't fail the page. This matches how ReadDeadLetterBodyAsync treats unreadable dead letters.
• Add a compliance test in MessageStoreCompliance: one tenanted and one untenanted scheduled envelope, each listed with its own tenant (or null).

The cost is one extra body column per listed row, for a paged query (default page size 100).

🤖 Generated with Claude Code