Block delete for in-progress access review campaigns

Reject deletion while a campaign is fetching sources so workers are
not racing a removed record. All other statuses remain deletable.

Signed-off-by: Cursor Agent <cursoragent@cursor.com>

Co-authored-by: Bryan FRIMIN <bryan@frimin.fr>

pkg/accessreview/errors.go

@@ -30,6 +30,7 @@ import (
 var (
 	ErrCampaignMissingSources    = errors.New("access review campaign missing scope sources")
 	ErrCampaignNotDraft          = errors.New("access review campaign not draft")
+	ErrCampaignNotDeletable      = errors.New("access review campaign not deletable")
 	ErrCampaignNotPendingActions = errors.New("access review campaign not pending actions")
 	ErrCampaignCompleted         = errors.New("access review campaign completed")
 	ErrCampaignCancelled         = errors.New("access review campaign cancelled")
@@ -44,6 +45,10 @@ type (
 		CampaignID gid.GID
 	}
 
+	CampaignNotDeletableError struct {
+		CampaignID gid.GID
+	}
+
 	CampaignNotPendingActionsError struct {
 		CampaignID gid.GID
 	}
@@ -84,6 +89,21 @@ func (e *CampaignNotDraftError) Is(target error) bool {
 	return target == ErrCampaignNotDraft
 }
 
+func NewCampaignNotDeletableError(campaignID gid.GID) error {
+	return &CampaignNotDeletableError{CampaignID: campaignID}
+}
+
+func (e *CampaignNotDeletableError) Error() string {
+	return fmt.Sprintf(
+		"access review campaign %q cannot be deleted while it is in progress",
+		e.CampaignID,
+	)
+}
+
+func (e *CampaignNotDeletableError) Is(target error) bool {
+	return target == ErrCampaignNotDeletable
+}
+
 func NewCampaignNotPendingActionsError(campaignID gid.GID) error {
 	return &CampaignNotPendingActionsError{CampaignID: campaignID}
 }