add client-facing expected_version compare-and-set on update and delete

[fabracht]

Summary

• Adds a client-facing compare-and-set: a write may carry a reserved _expected_version in its payload, and the server rejects the operation if the row's current _version differs.
• The rejection is terminal — PreconditionFailed (transport code 412), which the write-retry loops treat as non-retryable, distinct from an optimistic-concurrency Conflict that is retried.
• Enforced identically in agent mode (update_with_expected/delete_with_expected) and in both cluster write paths (client-dispatched local-primary and forwarded).
• _expected_version is stripped before validation and storage, so it never persists as a field; omitting it leaves behavior unchanged. Embedded (WASM) mode ignores it.
• Second primitive of on-disconnect hold reclaim (docs/design/hold-reclaim.md): a janitor reclaims an abandoned hold with a delete guarded on the last-observed version, so a holder that renewed in the meantime is never clobbered.

Test plan

• cargo make clippy — zero warnings across the workspace and the wasm target
• cargo make test — core/agent/vault/cluster suites pass
• agent terminal-CAS counter-test (retry loop does not defeat the precondition)
• cluster_update_delete_expected_version_cas covers both cluster write paths