fix(convo_miner): stop sweeper drawers being purged, abort on failed purge

[KeilerHirsch]

Problem

Two related gaps found in convo_miner.py's purge-before-rebuild path:

1. _metadata_matches_extract_mode's legacy-compat rule sweeps up the sweeper's own drawers. The sweeper is a separate ingest path that writes drawers with no extract_mode field at all — its own metadata schema (ingest_mode="sweep", session_id, role, ...) never included that key, because it was never meant to. _metadata_matches_extract_mode (shared by file_already_mined and convo_miner's own _source_file_delete_ids) treats any drawer with no extract_mode as a legacy exchange-mode row, to stay compatible with genuine pre-schema convo_miner drawers. Since mempalace mine --mode convos defaults --extract to exchange, and both the sweeper and the convo miner are meant to run over the same transcript directory, the very next mine --mode convos re-mine of a session file the sweeper already swept scoops up all of that session's sweeper-written drawers into the purge and deletes them — not because of an exception, but because the selection criterion itself can't tell the two producers apart. Recovery only happens if the sweeper is re-run against the same still-existing file path before it's archived/rotated; otherwise the loss is silent and permanent.

2. Purge-failure swallow (own instance of the same pattern already fixed for miner.py's process_file). _file_chunks_locked wraps its delete-ids lookup and the delete call in one except Exception: logger.debug(...), then proceeds to insert the new chunks regardless of whether the purge succeeded. A transient backend error then leaves stale/duplicate drawers under mixed schema versions, with no operator-visible signal beyond a debug log.

Fix

• _metadata_matches_extract_mode's legacy-compat fallback now only applies when the drawer is otherwise convo_miner's own — no ingest_mode at all (a genuine pre-ingest_mode-schema convo row), or convo_miner's own "convos" tag. A drawer positively identified as another producer's (ingest_mode="sweep", or any other foreign value) is excluded, using the same ingest_mode discriminator sync.py already relies on for its own registry-row check.
• A failed purge in _file_chunks_locked now aborts (skipped=True, leaving the old drawers' stored mtime untouched so the next mine retries) and prints a visible warning, instead of falling through to upsert.

Tests

New tests in tests/test_palace.py (direct unit coverage of _metadata_matches_extract_mode's three-way logic, including the exact sweeper-row case) and tests/test_convo_miner_unit.py (an integration-style test of _source_file_delete_ids proving a sweeper row survives a default exchange-mode purge, and a _file_chunks_locked test proving a purge failure aborts before upsert). Each was confirmed to fail against the pre-fix code and pass after the fix. Full existing suite across test_palace.py, test_convo_miner*.py, test_sweeper.py, and test_miner.py still passes — no regressions.