fix(metadata): fail loudly when the sidecar write cannot land

update_model_metadata ignored the save_metadata result, so a fetch on a
drive that went offline mid-run was counted as success: the cache got
the fresh CivitAI payload while the durable sidecar never landed, and
every later fetch skipped the model as already fetched.

The save result now raises MetadataPersistError. In the bulk fetch path
this fails the item (reported in the summary, cache untouched, model
stays eligible for the next run); relink surfaces an honest 500.

Also corrects the stale known-limitation note in the scoped-scan plan:
a startup-offline root has been listed and re-admitted since Wave 6.

docs/plans/issue-1108-scoped-scan.md

@@ -364,8 +364,9 @@ differs per mode and that matters:
   unioned rather than replaced whenever the scan did not verify every root); the next full refresh
   drops them.
 - `root_details[].reachable` is a live `os.path.exists()` per root, so a root that disappears
-  mid-session shows as offline; a root that was already gone at startup is filtered out by
-  `Config` and therefore absent from the list.
+  mid-session shows as offline; a root that was already gone at startup is still listed thanks
+  to Wave 6 (`available: false`, cached count), and `/roots` re-admits it once the directory
+  is back.
 
 ## Verification checklist