rvf: three ADR-280 changes survive mutation testing (test coverage gaps)

Found during ADR-280 review via mutation testing. All 11 metadata_growth tests stay green when these are broken:

1. dropped_generations accumulation (store.rs:3984) — deleting it leaves every test passing, because assertions are all > 0 or == 0; no test pins an exact count. The CLI prints this number to users.
2. delete/set_file_metadata rollback via full clone (:1496/:1543, :2815/:2834) — reverting to truncate is only detectable via ENOSPC, which the suite never exercises. (Verified load-bearing by hand: with truncate, an ENOSPC run permanently drops a live Meta entry and retains an uncommitted one.)
3. the if re_anchoring { … retain … } prune block (:3830-3836) — deleting it is benign for convergence since orphans sit below the new snapshot, but it leaves the pruning half — the entire reason orphaned_metadata_offsets exists — unpinned.

One test each when convenient. An ENOSPC harness (small RAM disk) would cover #2 and is reusable.

Also informational (store.rs:1496, pre-existing): a delete() that fails before its manifest commits leaves its Journal segment in segment_dir, because the append happens above the rollback snapshot point. Harmless — the deletion isn't applied and the id stays queryable — but it makes the "snapshot everything visible first" comment at :1490-1493 inexact.

🤖 Generated with claude-flow

Start in store.rs at lines 3984, 1496/1543, 2815/2834, and 3830-3836, then run the existing metadata_growth tests. Add one regression test for the exact dropped_generations count, one ENOSPC rollback test for metadata changes, and one test pinning re-anchoring pruning. Done means these tests fail when each targeted behavior is removed.