Webhooks matched rows only by subscription ID, so a paid row without one
stayed active after the customer canceled. The deleted and updated events
now verify such a row, the verify job also finds canceled subscriptions,
and the invoice-failed job counts only invoices of the row's subscription.
cloud:sync-stripe-subscriptions reports these rows, and
cloud:fix-subscription --verify-all writes its CSV to a file and shows
details only with -v.
