[Store] Make non-conflict standby-restore rejections durable

[Store] Follow-up: make non-conflict standby-restore rejections durable

Split out from the #3806 review discussion with @Icedcoco.

#3806 makes conflict-derived discards durable: when the tolerant standby restore drops ambiguous overlapping descriptors, it writes a fenced OpLog record per affected key (REMOVE for full drops, PUT_END with only the surviving descriptors for partial ones) and fails the restore unless the batch goes durable.

The other rejection kinds still only produce a log line and a metric: `unknown_endpoint`, `invalid_memory_descriptor`, `capacity_overflow`, `invalid_tenant_id`. A later promotion that replays the same snapshot re-rejects the same entries every round. That is safe and idempotent, but it is repeated work, and for permanently-invalid entries (bad descriptor shape) a durable tombstone would be the cleaner end state.

The subtlety that kept this out of #3806: some rejection reasons are transient. `capacity_overflow` in particular reflects this promotion's capacity view, not the entry's validity, so a durable REMOVE could suppress an entry that a later, roomier promotion should accept. `object_already_exists` / `duplicate_object` must never tombstone either, since the key legitimately exists in the index.

Proposed shape when someone picks this up: a per-reason allowlist on the rejection funnel (`NoteLegacyStandbyRejection`) for the permanently-invalid kinds only, reusing the existing `repair_remove_keys` durable write path, with the transient kinds explicitly excluded.

Not blocking #3806; conflict-derived discards are already durable there.

Start by reading the #3806 review discussion and tracing the rejection funnel at NoteLegacyStandbyRejection, along with the existing repair_remove_keys durable write path. Identify which rejection reasons are permanently invalid versus transient, then make only the allowed reasons durable while explicitly excluding capacity_overflow, object_already_exists, and duplicate_object. Done means later promotion replay no longer repeatedly rejects permanently invalid entries, without suppressing entries that may become valid.

Written by the indexing model from the issue text.