fix(cohort): defer membership sync for unlinked targets and reconcile on link

[jorisjonkers-dev-agents]

Summary

Cohort membership ADD for a cohort with no linked external target failed terminally with CohortTargetNotLinkedException, so every manual member-add to an unlinked cohort (e.g. "Members 2024-2025" / "Members 2025-2026", which have no Brevo list linked) became a red failed job, and the members never converged even after a target was later linked.

• A membership ADD for a cohort with no linked target is now a benign, deferred no-op: it logs a warning and returns instead of failing the job. The desired cohort_member row stays unsynced and converges later, rather than flooding the execution monitor with failures.
• linkExisting now enqueues a ReconcileList for the cohort after recording the target id. The reconcile path already re-enqueues SyncCohortMembership ADD for desired-but-absent members (enqueueFollowUpsForMissing), so once an operator links a target to a previously-unbound cohort, its already-desired members are pushed automatically.

Together: a not-yet-linked cohort no longer produces failed jobs, and linking its target makes the pending members converge on their own. No API surface changes.

Verification

• ./gradlew :services:api:test --tests '*CohortMembershipSyncServiceTest' --tests '*CohortTargetingServiceTest' --tests '*CohortRemediationServiceTest' --tests '*cohort*' — 111 passed
• ./gradlew :services:api:compileKotlin :services:api:compileTestKotlin
• git diff --exit-code -- services/api/openapi.json — clean

The change was reproduced first with failing tests (the membership add asserted no exception; linkExisting asserted a reconcile enqueue), then fixed.