[Subtask]: Implement CN and frontend metadata authority fencing

### Parent Issue

Parent issue: #26227

### Detail of Subtask

Implement CN/frontend metadata authority and terminal validation behind a default-disabled feature gate.

Deliverables:

- Separate planning leases and lifecycle-sensitive metadata authority leases.
- Planner-produced metadata dependency classification for direct, prepared, cached, and cursor paths.
- Epoch validation before response packet/flush and before transaction COMMIT.
- Metadata-only authority-expiry containment; ordinary SQL and the CN process remain available.
- Background recovery lock ordering: wait for the catalog/View gate while holding nothing, then FastFail the SNAPSHOT gate.
- Whole-owned-transaction restart for valid RC retry boundaries; no partial retry from the middle of admission/lock/validation.

Acceptance criteria:

- Ordinary base-table SQL remains available during authority expiry.
- `SHOW COLUMNS`, `information_schema.columns`, and View metadata fail closed when authority is unavailable.
- Prepared/cache/cursor paths cannot return stale metadata.
- Wait-for-graph, cancellation, race, Data Branch, restore, and COMMIT fencing regressions pass.
- No unbounded retries, sleeps, leaked leases, or whole-CN shutdown are introduced.

### Describe implementation you've considered

Planner dependency metadata is authoritative; do not classify sensitivity from SQL text. Use short cursor leases and synchronous terminal validation rather than relying on timers for correctness.

### Additional information

Depends on the approved barrier and durable catalog recovery subtasks under #26227.