[manager] bound P2P host cache queries

[charpty]

Summary

Standalone follow-up to #277, rebased onto the latest codex/mu-main at ce7a6c1f.

This PR contains only the remaining P2P query scalability and correctness work. It does not add protobuf/API compatibility code and does not include the previously explored storage availability, unavailable-backend event filtering, or service-metrics fallback changes.

Why this change is needed

With p2p_host_count > 0, both ordinary and Mamba queries still materialized two request-wide key -> host -> set<spec> graphs. At one million keys this creates an object graph proportional to key * host * spec, dominating both RSS and latency. Caching around the old reducer would not remove that asymptotic cost, so the two P2P reducers are replaced rather than patched locally.

Implementation

• Add MetaIndexer::PrefixVisitOrder::ORDERED: backend chunks are read in bounded parallel windows, while stateful visitors consume callbacks in absolute key order. Existing callers keep the concurrent default.
• Ordinary P2P interns host names to request-local dense IDs, projects only one key at a time, and maintains peer-prefix intersections only for the dynamic final top-N hosts.
• Mamba P2P uses up to three bounded ordered phases: local scoring, independent F* full-group peer planning plus L* state-coverage voting, and final validation/projection only when an actual peer plan is selected.
• Empty spec groups remain vacuously satisfied but allocate no peer tracker or fetch range. When every F/L group is empty, Mamba returns after the single local scan.
• Preserve each full group's independent selected fetch range even beyond the shortest combined match prefix, so p2p_1_fetch remains exact; repeated block-key values are de-duplicated.
• Revalidate each selected plan against the final metadata view. Hard read errors are propagated and inconsistent peer plans fail closed instead of returning a partial result.
• Backends without progressive local reads perform one compact batch read and replay that same batch for later Mamba phases, preserving one backend I/O rather than introducing repeated remote reads.
• Aggregate backend wall time across all progressive Mamba phases instead of leaving the metric at the final scan only.

The production diff is concentrated in meta_searcher.cc (the two old reducers are replaced) and meta_indexer.{h,cc} (the ordered visitor). Most of the remaining added lines are the independent oracle, edge tests, and manual benchmark.

Preserved semantics and edge coverage

• dynamic top-N selection and lexical tie-breaking
• independent full-group peers and one state-coverage peer
• F* / L* group classification from current mu-main, with no legacy-name fallback
• Eagle pop boundaries, including selected fetches at the popped boundary
• empty spec groups, multiword masks over 64 specs, medium/status/URI filtering
• duplicate block-key fetched-count de-duplication
• metadata misses, hard errors, and metadata changes between Mamba phases
• non-progressive backend single-read behavior
• no final pass when no peer is selected

A deterministic materialized map/set oracle compares every output field for ordinary and Mamba queries over 6000 keys, 7 hosts, three medium filters, Eagle on/off, and top-N 0/1/3/7.

Performance evidence

Strict same-machine A/B on mu-main@16809002, Release/O2, four query workers, pure-local metadata, one million keys, and a peer-covered local gap at key 1024:

Scenario	Before	This PR	Change
ordinary P2P p50	632.07 ms	162.81 ms	-74.2%
Mamba P2P p50	635.87 ms	370.01 ms	-41.8%
peak RSS	1,340,012 KiB	586,120 KiB	-56.3% (about -736 MiB)

After rebasing to ce7a6c1f, the final manual smoke benchmark passed and measured 176.30 ms ordinary / 407.05 ms Mamba on the shared development machine. These values are regression evidence, not an online SLA.

Validation

• external full ASAN: 110 passed, 1 repository-configured skip, 0 failed
• internal full ASAN with --config=vcns, including Vcns/TairMempool/Pace tests: 113 passed, 1 repository-configured skip, 0 failed
• final Release million-key benchmark passed and validated local, p2p_1_fetch, and p2p_1_total_match
• formatting, diff checks, secret-pattern scan, one-commit scope, and clean worktree verified

Deliberate trade-offs

• Pure-local Mamba uses up to three bounded scans to remove the request-wide object graph. Later phases revisit only ranges needed by selected plans, so the local metadata LRU/revisit instrumentation can observe internal reads.
• Non-progressive backends retain one compact request batch in memory. Their memory is therefore not fully streaming, but they avoid repeated remote I/O and no longer create the two additional per-key map/set graphs.
• Exact distinct fetched-key reporting requires storage proportional to the number of fetched block keys; the large key * host * spec state is removed.

The branch contains one commit and remains Draft for review.