As a follow on to #89540, we need to deal with the following:

1. Stash the ID of the protected timestamp ID during job creation, so that we can easily clean up if things go wrong, instead of relying on the collection mechanism in pathological scenarios
2. Clean up the dependencies involved in installing protected timestamps and ideally move this logic into an interface, which can update or set this as needed.

Jira issue: CRDB-20939