keyspace: prevent deleting assigned meta-service groups

## Bug Report

### What problem does this issue address?

The dynamic keyspace config path can replace `keyspace.meta-service-groups` without checking the persisted meta-service group assignment counts. If a group that already has assigned keyspaces is removed, existing keyspace metadata can still reference the removed `meta_service_group_id`, while the in-memory meta-service group set no longer contains it.

There is also a race with manual keyspace config updates. `UpdateKeyspaceConfig` currently checks whether the target `meta_service_group_id` exists and then updates the assignment count without holding the meta-service group manager lock for the full transaction. A concurrent meta-service group config update can remove the same group between the existence check and the assignment count update.

### Impact

This can leave inconsistent state:

- keyspace config points to a deleted meta-service group;
- assignment count exists for a group that is no longer available;
- future group status and assignment decisions can become misleading.

### Expected behavior

- Deleting a meta-service group with assigned keyspaces should be rejected.
- Manual keyspace assignment changes should be serialized with meta-service group set updates, so the existence check, assignment count update, and keyspace metadata save cannot race with group deletion.

### Notes

This is present on current `master`; it is not specific to the JSON merge patch changes being discussed in #10881.