Expire unconsumed native metadata preparations atomically

[Ivanbeethoven]

New native metadata preparations receive one immutable PostgreSQL deadline grant. After that fixed deadline, a private transaction can expire an unconsumed PREPARING or COMMITTED preparation, record one immutable expiry event and release only its exact Prepare pins. Shared lease/workspace/local references and immutable payload bytes remain retained. Historical preparations have an explicitly unknown deadline and cannot be expired or silently assigned a new TTL.

The grant binds storage, operation, manifest, duration, prepare identity and the database clock sampled after locks. Retries never extend it. Installation, finalization and new lease consumption reject elapsed preparations. An already consumed lease operation remains recoverable after the deadline. COMMIT errors carry an opaque grant-bound recovery witness; fresh-primary recovery verifies the captured storage, barrier, immutable event and terminal state without repairing references or granting read authority.

This private metadata primitive is stacked on #46 at abd8737. Runtime/body serving, lease renew/release/read-pin lifecycle and physical collection remain separate; MST/2 wire and schema2 are unchanged.

Validation at final head 4d83a17:

• Complete Linux repository gates passed: nightly formatting, strict all-target/all-feature Clippy, both builds, real isolated PostgreSQL/Redis/RustFS dependencies, cargo test --all and cleanup. Eighteen test targets reported 2320 passed, zero failed and two existing ignored; the main library reported 2093 passed.
• The full log verifies all 63 selected actual regression results: 14 preparation-expiry tests, 16 installation tests, nine lease tests, eight filter tests, 15 upstream namespace tests and the import-alias regression. Coverage includes fixed-duration recovery, elapsed receipts, preserved partial payload/shared pins, outer rollback, missing coverage, actual barrier waits, actual before/after COMMIT disconnects, wrong primary/query failure, invalid DDL, forward migration and consumed-operation replay after the Prepare deadline.
• Two independent source reviews passed at this final head. Upstream source main ddf38b1 is included through an ordinary merge. Its three-path namespace synchronization is preserved verbatim while existing native projection/retention checks remain intact. The subsequent upstream main change at 5e84b40 only updates the upstream planning document. Local HEAD, remote branch and PR HEAD agree; the worktree is clean, the PR is MERGEABLE/CLEAN and no review threads are unresolved.

Only source, test and additive schema paths are included. Planning documents, reports and credentials are excluded; the frozen performance experiment remains undispatched.