fix(scripts): make MAX_DELETE_PCT actually honor env override

The script's own help text documents \`MAX_DELETE_PCT=62 ./sweep-cf-orphans.sh\`
as the way to relax the safety gate, but the in-script assignment on line 35
was unconditional and overwrote any env value — so the override never worked.

During today's staging tenant-provision recovery (CP #255 context), hit the
57%-delete threshold and needed the documented override to clear 64 orphan
records. The one-char change to \`\${MAX_DELETE_PCT:-50}\` honors the env
while keeping the 50% default when no caller overrides.

Ran with MAX_DELETE_PCT=62 after the fix — deleted 64 records, CF zone 111→47.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

scripts/ops/sweep-cf-orphans.sh

@@ -32,7 +32,7 @@
 set -euo pipefail
 
 DRY_RUN=1
-MAX_DELETE_PCT=50   # refuse to delete more than half the records in one run
+MAX_DELETE_PCT="${MAX_DELETE_PCT:-50}"   # refuse to delete more than this pct of records in one run; caller can override via env
 REGION="${AWS_DEFAULT_REGION:-us-east-2}"
 
 for arg in "$@"; do