fix(delete): merge delete batches manifest-only, never move files

Bulk delete merged staged batches by physically moving each loser's
files into the winner's batch dir with os.rename. Cross-volume bulks
(winner and loser on different filesystems) always hit EXDEV, forcing a
rollback and degrading to the batch_ids array with per-batch undo.

Merge is now manifest-only: loser entries are appended to the winner's
manifest with their staged paths unchanged, so staged files keep living
in each model's own .lm-pending-delete/<batch_id> dir (no data IO, no
EXDEV). Loser dirs are recorded in the winner manifest's merged_sources
and each loser manifest is stamped merged_into so its own purge timer, a
post-restart sweep or a direct undo call no-op. A cross-volume bulk is
one undoable batch again, and undo/purge clean up the loser dirs once
the merged batch settles.

py/services/recipes/persistence_service.py

@@ -533,7 +533,7 @@ class RecipePersistenceService:
                 # Merge succeeded: one undo action covers the whole bulk.
                 payload["batch_id"] = merged_batch_id
             else:
-                # Merge failure (e.g. cross-volume move): expose the constituent
+                # Merge unresolvable (defensive): expose the constituent
                 # batches so the caller can undo them one at a time.
                 payload["batch_ids"] = batch_ids
         else: