feat: Define exclusive namespace ownership for the initial OpenDAL cache

Part of #1350. The first version uses a fresh, exclusive namespace, one cache owner, a process-local index and RecoverMode::None. Settle this small usage contract in the engine and example; do not build recovery or shared-cache coordination as a prerequisite.

First-version blockers

• Document how callers provide a fresh exclusive namespace and that a restart starts with an empty index and a new namespace. Reject unsupported recovery modes; shared writers and namespace reuse are unsupported.
• Keep object names and cleanup within the owned namespace. Verify that unrelated application/cache objects cannot be removed.
• State what close attempts to remove, what can remain after a crash or failed cleanup, and who reclaims it. Explicit caller/operator-owned reclamation is acceptable; the engine must not silently promise physical-space recovery.
• Verify fresh-instance/restart behavior and cleanup isolation on the supported backends, including rejection of unsupported configuration. Testing restart does not require recovering the old index.

Close this issue when the documented exclusive/no-recovery lifecycle is usable and checked. Namespace isolation may follow from construction and validation; it does not require a distributed ownership service.

Possible follow-ups — not blockers

Restart recovery, safe reuse of an old namespace, automatic orphan sweeping, shared caches, multiple writers, cross-instance quotas and invalidation. Consider them only for concrete callers; shared-cache work is related to #390. Durable format compatibility is only needed if recovery is later supported.