fix: harden storage consistency and blob admission

[beinan]

Summary

Fix data loss and inconsistent reads during rollout schema upgrades, peer WAL merges, and checkout; enforce blob admission before allocating payloads; and make dataset deletion remove data through its storage backend.

• Evolve additive rollout schemas before encoding writes and tolerate another opener completing the same upgrade. Preserve new fields through WAL merge and reopen. Closes Preserve new rollout fields when writing to datasets with an older schema #244.
• Refresh list/page snapshots and retry when a merge changes base during the read or a generation disappears after an earlier base commit. Missing generations trigger up to three attempts even when the base version stays unchanged; persistent failures retain the final error. Closes Keep rollout list results consistent when another worker drains MemWAL into base #245.
• Reserve memory before polling a blob load and retain the reservation through response streaming. Unknown lengths use exclusive admission; smaller downloads release unused capacity after loading. Closes Reserve download memory before materializing rollout blobs #246.
• Account for chunked uploads without Content-Length and release reservations on failure or cancellation. Closes Account for chunked rollout uploads in the global blob memory budget #247.
• Serialize uniqueness validation through the visible append for default ContextStore writes. Trusted deferred-seal bulk writers retain their existing opt-out semantics. Closes Serialize ContextStore uniqueness validation with concurrent appends #248.
• Exclude live WAL from checked-out base versions, including point/blob reads and observations. Checked-out handles reject writes, upserts, updates, tombstones, external payload uploads, schema changes, compaction, and index creation until refresh_latest(). Periodic and already-prepared merges preserve the pin. Closes Exclude live MemWAL generations from explicitly checked-out snapshots #249.
• Track live rollout/datagen/generic handles independently of LRU residency with weak references; reuse evicted live handles and serialize each name's create/open/delete operations. Close and fence local writers, delete via the configured object store, and remove registry/cache entries only after deletion succeeds. Cover rollout, datagen, generic, and context stores; failed deletion remains retryable and deleted handles cannot resume appending. Closes Delete dataset URIs through object storage and propagate deletion failures #250.

Unknown-size admission is deliberately conservative when ROLLOUT_MAX_INFLIGHT_BLOB_BYTES is enabled and can reduce concurrency. Uniqueness serialization is per handle; applications still coordinate keys across processes. Dataset deletion requires remote writers to be quiesced.

Testing

• Project CI helper completed successfully: workspace formatting, Clippy (--workspace --all-targets -- -D warnings), all-target Rust tests, Python tests, Ruff formatting/lint, and Pyright.

• Rust workspace: 392 passed, 0 failed, 25 ignored. The 22 etcd-backed master tests also passed separately on 948b970 against local etcd 3.7.0; this follow-up does not change master code. The remaining 3 ignored tests are existing benchmarks/manual checks.

• Rebuilt the Python extension from this tree with maturin. Python 3.13: 215 passed, 6 skipped, 1 existing xfail for per-append version advancement under MemWAL. The new merged-version checkout regressions pass.

• Added 21 regression tests covering both key types, concurrent schema upgrades, stale and interrupted list scans, checkout during a prepared merge, read-only snapshot mutations, post-commit WAL cleanup and bounded retries, blob admission before loading, cancellation, counter overflow, URI deletion/recreation, evicted live handles across all LRU store kinds, weak-registry cleanup, and deletion failure/retry. Updated the legacy-schema fixture to actually construct the old schema before testing migration.

• All 10 GitHub CI checks passed for b7d1669, including Rust tests and coverage, Python 3.11 tests, all three wheel builds, and style checks.