Automatic completion of parent workflows can violate status invariants

https://debusine.debian.net/debian/developers/work-request/212868/ ended up in an odd state, as follows (many details omitted):

• debian_pipeline (Running) (212868)
  • QA (reference) (Completed Success) (212992)
    • autopkgtest (Completed Success) (212993)
    • autopkgtests of reverse-dependencies (Blocked) (212994)

Looking at the orchestrator log, I see:

Fri 2025-10-24 11:28:00 UTC poseidon debusine-server-celery.service[2920800]: Marked WorkRequest 212992 as pending
Fri 2025-10-24 11:28:00 UTC poseidon debusine-server-celery.service[2920800]: Marked WorkRequest 212992 as running
Fri 2025-10-24 11:28:01 UTC poseidon debusine-server-celery.service[2920800]: Marked WorkRequest 212993 as pending
Fri 2025-10-24 11:28:01 UTC poseidon debusine-server-celery.service[2920800]: Marked WorkRequest 212993 as running
Fri 2025-10-24 11:28:01 UTC poseidon debusine-server-celery.service[2920800]: Marked WorkRequest 212993 as completed
Fri 2025-10-24 11:28:01 UTC poseidon debusine-server-celery.service[2920800]: Marked WorkRequest 212992 as completed

So the autopkgtest workflow completed immediately rather than scheduling any tasks (which is a separate problem that I haven't yet investigated). maybe_finish_workflow then immediately completed the parent workflow because at that point it had no remaining children in progress; and then the workflow orchestrator went on to populate some more children. The effect was to violate the invariant that workflows may only be completed if all their children are completed.