fix(storage): quarantine partial HNSW flush without metadata

[fatkobra]

What does this PR do?

Fixes #1274.

This tightens _segment_appears_healthy() so a missing index_metadata.pickle is treated as healthy only when the HNSW segment still looks fresh or effectively empty.

If data_level0.bin already has non-trivial payload but index_metadata.pickle is missing, the segment is now treated as partially flushed corruption and quarantine_stale_hnsw() renames it before Chroma opens the native HNSW reader.

What changed

• Added _HNSW_MISSING_METADATA_DATA_FLOOR.
• Updated _segment_appears_healthy():
  • missing index_metadata.pickle + tiny/empty data_level0.bin remains healthy
  • missing index_metadata.pickle + non-trivial data_level0.bin is unhealthy
  • OSError while checking the payload is treated as unsafe
• Added regression tests for:
  • non-trivial HNSW data without metadata
  • tiny data without metadata
  • quarantine behavior for the SIGSEGV in chromadb bindings.count() on develop tip; _segment_appears_healthy false-negative for partially-flushed segments #1274 partial-flush shape

Why

#1274 reports a real palace with this segment state:

data_level0.bin       167600 bytes
header.bin            100 bytes
length.bin            400 bytes
link_lists.bin        0 bytes
index_metadata.pickle MISSING

## How to test
ruff format mempalace/backends/chroma.py tests/test_backends.py
ruff check mempalace/backends/chroma.py tests/test_backends.py
python -m pytest tests/test_backends.py -q
python -m pytest tests/test_backends.py tests/test_repair.py -q
python -m pytest tests/ -q

## Checklist
- [x] Tests pass (`python -m pytest tests/ -v`)
- [x] No hardcoded paths
- [x] Linter passes (`ruff check .`)

[igorls]

Maintainer-edit: merged develop in to resolve conflicts opened by #1339 (bloated link payloads, merged earlier today).

`_segment_appears_healthy` now stacks three complementary checks:

1. `_hnsw_payload_appears_sane` (fix(storage): quarantine bloated HNSW link payloads #1339) — link_lists.bin / data_level0.bin ratio guard
2. missing-metadata + non-empty data floor (this PR) — partial-flush detection
3. pickle format sniff (original) — protocol-byte corruption detection

Each catches a different shape of broken-on-disk segment. Local: 1618 tests pass on the merge, ruff lint+format clean against the 0.4.x CI pin.