[EPIC] Support metadata undelete for metalake-scoped roots

### Describe the proposal

Child of #12187.

Linear tracking: [DAT-323](https://linear.app/datastrato/issue/DAT-323/support-metadata-undelete-for-metalake-scoped-roots)

Support standalone metadata-only undelete for policies, users, groups, roles, job templates, and tags using the shared conditional recovery contract.

Standalone recovery restores each definition only. It does not cascade into associations, ownership, grants, executions, or other metadata objects, and it does not call identity providers, authorization plugins, executors, catalogs, or downstream systems.

Depends on: #12188

This lane can proceed in parallel with catalog-scoped leaves and container cascade hardening. Whole-metalake recovery in #12190 waits for these root semantics.

### Task list

- [ ] **TBD** — Support standalone policy and tag undelete without restoring associations, ownership, or grants
- [ ] **TBD** — Support standalone user, group, and role undelete without external identity or authorization reconciliation
- [ ] **TBD** — Support standalone job-template definition undelete without execution state
- [ ] **TBD** — Complete root REST, Java client, OpenAPI, replay, conflict, and transaction tests