refactor: clarify metadata state machine boundaries

[GatewayJ]

Summary

• Split metadata commands and state machine logic out of the gRPC service adapter
• Separate feature-gated local Raft propose boundary from RocksDB persistence primitives
• Add defensive snapshot decoding, safer snapshot temp files, and regression coverage for failed command state preservation

Test Plan

• cargo fmt --all -- --check
• cargo test --workspace --lib
• cargo check --workspace --all-targets
• cargo test -p coldstore-metadata --lib --features metadata-raft
• cargo test -p coldstore-metadata --lib --features metadata-raft-rocksdb
• cargo clippy --workspace --all-targets -- -D warnings
• cargo clippy -p coldstore-metadata --all-targets --features metadata-raft -- -D warnings
• cargo clippy -p coldstore-metadata --lib --features metadata-raft-rocksdb -- -D warnings

Safety

• Does not start real services
• Does not access Tape/SPDK devices
• Keeps Raft/RocksDB paths feature-gated and opt-in