fix(delete): merge delete batches manifest-only, never move files

Bulk delete merged staged batches by physically moving each loser's
files into the winner's batch dir with os.rename. Cross-volume bulks
(winner and loser on different filesystems) always hit EXDEV, forcing a
rollback and degrading to the batch_ids array with per-batch undo.

Merge is now manifest-only: loser entries are appended to the winner's
manifest with their staged paths unchanged, so staged files keep living
in each model's own .lm-pending-delete/<batch_id> dir (no data IO, no
EXDEV). Loser dirs are recorded in the winner manifest's merged_sources
and each loser manifest is stamped merged_into so its own purge timer, a
post-restart sweep or a direct undo call no-op. A cross-volume bulk is
one undoable batch again, and undo/purge clean up the loser dirs once
the merged batch settles.

py/services/model_scanner.py

@@ -2501,8 +2501,8 @@ class ModelScanner:
                     })
             
             # Merge every staged per-file batch into ONE undoable batch. On a
-            # merge failure (cross-volume EXDEV etc.) the response falls back
-            # to the constituent batch_ids array so the frontend can undo them
+            # merge failure (defensive) the response falls back to the
+            # constituent batch_ids array so the frontend can undo them
             # sequentially.
             batch_field: Dict[str, Any] = {}
             if batch_ids: