Store tombstones/version stamps for convergent deletes and overwrites

Summary

Introduce explicit tombstones and version ordering for replicated cache metadata so deletes and overwrites converge correctly across regions.

Why

In an eventually consistent full-replica mesh, simply removing local metadata is not enough. A lagging region can otherwise reintroduce deleted or overwritten state during delayed replication or repair.

Scope

• define version ordering for manifests and deletes
• persist tombstones for project cleanup and any future per-key delete path
• make repair/bootstrap respect tombstones
• add tombstone GC once all regions have had enough time to observe the delete
• add tests proving deleted data cannot be resurrected by stale peers

Notes

This is the minimum correctness mechanism needed before adding broader repair and peer-heal workflows.