Write a one-off Python cleanup script that won't need a second one to undo it

Write a one-off Python script for a specific data cleanup job. Even though this is a "throwaway" script, it's going to run against real data exactly once (or a few times if something goes wrong the first time), so it needs a dry-run mode and idempotency, not just a happy-path implementation.

WHAT NEEDS TO HAPPEN
Find all user records where email is stored in mixed case and normalize them to lowercase, merging any resulting duplicate accounts by keeping the older one.

DATA SOURCE
PostgreSQL production database, connecting via a read-write service account with a 30-second statement timeout.

HOW MANY RECORDS, ROUGHLY
About 900,000 user rows total, expecting roughly 12,000 to actually need changes.

WHAT COUNTS AS SUCCESS
Every email is lowercase, no two active accounts share the same normalized email, and the older account wins any merge.

RULES
The script must support a `--dry-run` flag that runs the exact same selection and transformation logic as the real run and prints/logs what it would change, without writing anything — implement this by having both modes call the same function to decide what changes, with only the final write step gated behind the flag, so the dry-run output can never drift from what the real run would actually do. Make every write idempotent: if the script is run twice against the same data (because it was killed halfway through, or someone re-runs it out of caution), running it again should produce the same end state rather than double-applying a change or erroring out. If the record volume is large enough that holding everything in memory at once is questionable, process in batches with progress output, and make sure a crash partway through a batch doesn't leave that batch in a half-applied state. Log every record that gets modified (its identifier and what changed) to a file, not just a summary count, so there's a concrete audit trail if something needs to be manually reversed later.

WHAT NOT TO DO
Do not write this as an inline script with no functions — structure it as at least a `find_candidates()`, `apply_change(record)`, and `main()` so dry-run and real-run can share logic. Do not catch a broad exception around the whole batch loop just to keep it running past errors; catch specific expected exceptions per-record, log them, and let genuinely unexpected exceptions stop the script rather than silently skip records.

OUTPUT FORMAT
1. The full script.
2. One paragraph on how to verify the dry-run output before running for real.
3. One paragraph on what the audit log lets someone manually reverse if needed.