Data\Definition carries no state, so a listing including withdrawn definitions cannot say which is which

Found while building module-ecommerce-reporting-api.

Queries\ListDefinitions($tenantId, activeOnly: false) returns list<Data\Definition>, and
Data\Definition is name, version, sourceKey, grain, windowDays, unit, currency. It
carries neither state nor withdrawn_at, both of which exist on Models\MetricDefinition.

So the activeOnly: false branch returns active and withdrawn definitions in one list with nothing
to tell them apart. MetricDefinition::toDefinition() is the only published way to a Definition,
and Data\Definition is also what a MetricSource is handed — which is presumably why state was
left off it, since a source is never asked about a withdrawn definition.

The API package therefore lists only the active definitions and does not publish the activeOnly
flag: a listing that cannot say which entries are withdrawn is worse than one that does not claim to
cover them. A merchant asking "why did this number stop" gets the answer from the run instead, which
refuses with definition_withdrawn.

Options, none obviously right: add state to Data\Definition and accept that a source is handed a
field it must ignore; give ListDefinitions a second return shape; or drop the activeOnly
parameter, since nothing can consume what it returns.

Start by reading Data\Definition, Models\MetricDefinition::toDefinition(), and Queries\ListDefinitions, then trace how the API package exposes the listing and how MetricSource consumes the value. Determine the public contract that can distinguish withdrawn definitions or remove the unsupported option, and add coverage for active and withdrawn results before considering the issue done.