cert_gen list views read cert_sent from sent_log.json

Bug: routes/cert_gen.py had its own _read_sent() copy reading CERTS/sent.json, used by /cert-gen/list (cert_sent / cert_sent_at) and /cert-gen/route-check/{id} (sent block). sent.json stopped being written when delivery tracking moved to cert_delivery_log → sent_log.json, so every cert delivered after that cutover showed cert_sent=false in those views.

Fix (entirely-api 3f264d0, follows up 16036fc): new _latest_delivery(record_id) in cert_gen reads the latest entry from cert_delivery_log._read_log() (which also migrates any remaining legacy sent.json on first read, so pre-cutover deliveries still surface). Dead _read_sent / _write_sent helpers removed from both routes/cert.py and routes/cert_gen.py. Tests in tests/test_cert_sent_flags.py (6, incl. a guard that the dead helpers stay gone).

Verified live: /cert-gen/list shows 234 sent certs, 17 from 2026-07-30 deliveries that were previously invisible.

Rule: delivery state is read ONLY via cert_delivery_log._read_log / _latest_delivery — never from sent.json.