feat(cluster): batched Raft commands for compaction manifests

[xe-nvdk]

Summary

• Replaces 40 sequential RegisterFile/DeleteFile Raft applies per compaction manifest with a single CommandBatchFileOps log entry, cutting apply latency from ~200ms to ~5ms for typical manifests
• New CommandBatchFileOps (type 10) FSM handler dispatches to existing idempotent register/delete helpers — all files in a batch share the same LSN (the batch log index), which is semantically correct since a compaction job's outputs are causally simultaneous
• ManifestBridge interface extended with BatchFileOps; CompletionWatcher.applyOne rewritten to issue one batch call while preserving the output_written → sources_deleted two-phase ordering invariant
• CommandBatchFileOps added to the forward-apply security allowlist with the same HMAC + role authorization as existing file-manifest commands
• 13 new tests across FSM, watcher, and bridge layers; all pre-existing tests updated and passing

Closes #399

Test plan

• go test ./internal/cluster/raft/... -run TestFSMBatch — 4 FSM tests (happy path, registers-only, unknown op type, empty batch)
• go test ./internal/compaction/... -run TestWatcher — all watcher tests including 4 new batch-specific ones
• go test ./internal/cluster/... -run TestCompactionBridge_Batch — 4 bridge tests
• go build ./... — clean build

[gemini-code-assist]

Code Review

This pull request optimizes compaction manifest processing by batching RegisterFile and DeleteFile operations into a single Raft log entry (CommandBatchFileOps). This change reduces Raft round-trips from O(N) to 1 per manifest, significantly cutting apply latency while maintaining idempotency and the two-phase write-then-delete invariant. The implementation includes updates to the CompactionBridge, Coordinator, Raft FSM, and CompletionWatcher, along with comprehensive test coverage. I have no feedback to provide.