Placeful 2.7 — capacity audit fixes, never-expire promo holds & privacy bundle

Highlights

Capacity audit fixes — round-2 capacity audit closed out: 16 findings fixed across booking admission, flexible windows, daily pools, waitlist, counters and read surfaces. Includes the full audit dossier under docs/capacity-audit/2026-10-r2/ and a 13-scenario InnoDB race matrix (CapacityRaceMatrixTest) now running in CI.
Never-expiring promo review holds — venues can set the promo-review hold window to 0 so PromoPending bookings hold capacity without a deadline (bookings.hold_never_expires); every capacity counter, expiry sweep, settle path and restore flow understands the flag.
Privacy & GDPR bundle — DSAR rights extensions (erasure ledger re-application, verified deletion pipeline, export requests), marketing double opt-out surfaces, consent receipts, staff clock telemetry opt-in, and scheduled PII scrubbing for orders and time-entry metadata.
Service-charge disclosure — guest order carts now show the venue's service charge and grand total before checkout.

Closed child capacity collapse — calculateCapacity() now sells only headroom on open children while keeping closed children's booked demand; capacityIgnoringChildStates() preserves state-agnostic figures for display, and isSoldOut() no longer reports sold-out when only a closed child collapsed availability.
Waitlist claim race — waitlist state transitions are atomic compare-and-swap updates (legal source states in the SQL WHERE, offer-expiry validated in SQL), so two guests can no longer claim the same offer.
FindSlot recommended closed areas — MCP and assistant FindSlot now gate candidates on isEffectivelyOpen().
Running events hidden — availability listings use eventNotEnded() instead of date >= now(), so still-running events stay bookable.
Assistant numeric bounds fail-closed — invalid or out-of-range capacity/min/max input is refused instead of silently clearing limits.
Flexible-window read surfaces — OTA, Reserve Google, MCP and assistant availability now read flexibleServiceRemaining() and topology-aware bounds instead of cached or duplicated child figures.

docs/capacity-audit/2026-10-r2/ — case matrix, findings, races, regression and sign-off dossiers.