Function remove_job_for_agent 

pub fn remove_job_for_agent(
    config: &Config,
    id: &str,
    agent_alias: &str,
) -> Result<(), Error>

Delete a job only if agent_alias owns it, in one statement.

The agent-facing tools authorize with a scoped read and then write. Ownership can change without the job id changing — the operator’s agent-rename cascade does exactly that — so a rename landing between the two lets the former owner still delete the job. Matching both columns in the DELETE closes that window. A row owned by someone else reports the same not-found error as a missing one, so the guard does not become an existence oracle.