Lost batch-mutation responses cannot repair persisted workspace references: needs server-side outcome reconciliation

### Summary

When a batch image mutation's response is lost to a transport-shaped failure (timeout, network drop, parsing error, 5xx), the client cannot know which names committed. Since #9394 it reports those names as failed while invalidating their caches as if the chunk had landed, so RTK-cached views reconcile on refetch — but persisted workspace references do not: `handleDeletions` strips deleted images out of canvas layers, nodes, and reference images only off a `deleted_images` payload, and a lost response has none. Effect: a delete that committed server-side can leave persisted slices pointing at gone images until the user notices 404s.

### Why the client cannot reconcile this alone

The obvious client-side move — probe the failing chunk's names via `POST /api/v1/images/images_by_names` and treat absent names as confirmed-deleted — is unsafe with that route's current semantics: it answers per-name authorization failures *and* per-name storage errors with a silent skip (`invokeai/app/api/routers/images.py`, `get_images_by_names`). A locked database therefore returns `200 []`, which would "confirm" every probed name as deleted and mass-prune workspace references for images that all still exist. Absence from that response is not evidence of deletion.

### Proposed fix (server-side)

Either of:

1. **Tri-state existence reconciliation**: a route taking `image_names` and answering per name `existing` / `gone` / `undecided`, where `gone` is asserted only on a positive `ImageRecordNotFoundException` read, storage errors answer `undecided`, and names the caller may not read answer `undecided` (no information leak). The client then moves `gone` names into `deleted_images` (running the normal deletion cleanup), keeps `existing` names failed (retry works), and leaves `undecided` names failed without cleanup. A fully unavailable database yields all-`undecided` and prunes nothing.
2. **Per-operation ids** on the batch mutations plus an outcome endpoint, as suggested in review — heavier, but also covers non-delete mutations and retry dedup.

### Context

Raised by @JPPhoto in review of #9394 (round of 2026-08-23: "Lost mutation responses leave stale local references... Recovery: add mutation ids and server-side outcome reconciliation"). #9394 ships the cache-invalidation half; this issue tracks the workspace-reference half, which needs a server-side source of truth. Related: #9531 (bulk-download replay after re-auth).