engine: decompose the global lock; cross-connection group commit (roadmap item 5)

The single engine-wide reader/writer lock is replaced by a lock hierarchy,
so writes to different collections no longer serialize on one mutex:

- Collections are heap-allocated, so their addresses are stable while a
  command holds a collection lock (the maps only store pointers).
- A catalog rwlock guards the database/collection maps: shared for every
  command (so a concurrent DDL cannot mutate the maps underneath it),
  exclusive for create/drop/dropDatabase. Each collection has its own
  rwlock; the ordering is always catalog -> collection -> log lock, never
  two collection locks at once (TTL sweep and compaction take collections
  one at a time).
- Command dispatch acquires the catalog + target collection locks for the
  handler's duration, resolving the collection (creating it for writes)
  under the catalog lock; create/drop upgrade to the exclusive catalog lock.
- Appends never fsync. Each write command's epilogue releases the
  collection lock, then commits once (seal + fsync) with a leader/follower
  group commit: the leader waits for writers mid-append (a pending counter)
  so its seal covers them, and followers whose records the seal covered
  skip their own fsync. Every acknowledged write is fsynced before its
  reply (crash pair verified); an unacknowledged write may vanish and a
  reader may observe a write before its fsync — ordinary w:1 j:true
  semantics instead of 'the log describes >= memory'.
- Compaction snapshots collections without the log lock (so a concurrent
  writer holding one can always finish its append) and retries when a
  writer appended mid-snapshot (detected via the record seq), then swaps
  under the log lock — no deadlock. The compaction trigger moved to the
  command epilogue and the TTL monitor.
- Engine.dup_index moved to the collection (per-command error paths).

Also lands two B-tree edge-case fixes driven by tests that were in flight:
a churned leaf full of dead bytes no longer splits with an empty right
half (the leaf is repacked before splitting, and an emptied node's page is
fully free again), and a slot-count split with all large records on one
side shifts records between the halves until the new record fits. Plus a
randomised fuzz test over key sizes (src/fuzz_split.zig) and the two
regression tests.

Measured (tests/e2e/results/phase6.txt): no regression on the
single-connection benchmark; concurrent durable-insert throughput ~5.1k ->
12.5k docs/s from 1 -> 8 clients, ~14.8k at 32. Verified: unit suite in
all three modes, all e2e suites, the kill -9 crash pair.

src/storage.zig

@@ -341,12 +341,8 @@ pub const Log = struct {
             try self.seal_block();
         }
         try self.block.appendSlice(self.gpa, buf.items);
-
-        if (!self.defer_sync) {
-            // Durable before the reply: seal this block and fsync.
-            try self.seal_block();
-            try self.file.sync(self.io);
-        }
+        // No sync here: durability is the commit point (Log.sync), which
+        // runs once per write command and coalesces across connections.
     }
 
     /// Compress and write the current block, then reset it. No-op when it is
@@ -653,6 +649,7 @@ test "append, replay, torn tail" {
     };
     try log.append_upsert("db1", "coll1", &doc_bytes, 1);
     try log.append_delete("db1", "coll1", &doc_bytes, 2);
+    try log.sync();
 
     var seen: std.ArrayListUnmanaged(u8) = .empty;
     defer seen.deinit(gpa);
@@ -697,6 +694,7 @@ test "record larger than the read chunk replays" {
     defer out.deinit(gpa);
     try bson.write_doc(&pairs, gpa, &out);
     try log.append_upsert("db", "big", out.items, 1);
+    try log.sync();
 
     var count: usize = 0;
     const Ctx = struct {
@@ -729,6 +727,7 @@ test "reject corrupt interior block" {
     const doc_bytes = [_]u8{ 0x0E, 0, 0, 0, 0x10, '_', 'i', 'd', 0, 42, 0, 0, 0, 0 };
     try log.append_upsert("db", "c", &doc_bytes, 1);
     try log.append_upsert("db", "c", &doc_bytes, 2); // a second block
+    try log.sync();
     log.close();
 
     // Corrupt the FIRST block's first record: flip a byte in the hashed
@@ -774,8 +773,12 @@ test "torn tail truncates cleanly and appends overwrite it" {
 
     var log = try Log.open(gpa, io, path);
     const doc_bytes = [_]u8{ 0x0E, 0, 0, 0, 0x10, '_', 'i', 'd', 0, 42, 0, 0, 0, 0 };
+    // One sync per record gives two blocks: the first is complete, the
+    // second is the one torn by the truncation.
     try log.append_upsert("db", "c", &doc_bytes, 1);
+    try log.sync();
     try log.append_upsert("db", "c", &doc_bytes, 2);
+    try log.sync();
     log.close();
 
     // Cut the file in the middle of the second block: a crash mid-append.
@@ -806,6 +809,7 @@ test "torn tail truncates cleanly and appends overwrite it" {
 
     // A new append overwrites from the replay end and replays cleanly.
     try log2.append_upsert("db", "c", &doc_bytes, 3);
+    try log2.sync();
     seen.clearRetainingCapacity();
     var log3 = try Log.open(gpa, io, path);
     defer log3.close();